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A SURVEILLANCE STRATEGY FOR A FOUR YEAR OPERATING 
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by 
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for the Degrees of Nuclear Engineer and 
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ABSTRACT 

If the U.S. nuclear industry hopes to remain competitive and grow into the next 
century, it must be willing to expand the goal of each plant from safe performance, to safe 
and economic performance, and apply this type of thinking in all its decision making 
processes. Economic performance can be improved by increasing the plant capacity 
factor. However, the current industry cycle lengths of 18 to 24 months are limited in the 
capacity factor gains they can achieve. The nuclear industry should consider focusing on 
strategies that will extend operating cycles to 48 months or more. Such a strategy should 
address required reliability and availability performance, and the surveillance requirements 
needed to attain a 48 month goal. 

A surveillance strategy necessary to achieve a 48 month fuel cycle was developed. 
The primary goals and objectives of the strategy were to overcome the regulatory and 
investment protection barriers to extended cycle lengths, provide a systematic surveillance 
resolution procedure, and provide a framework for addressing plant forced outage rates. 
As part of the strategy, a detailed methodology for determining the surveillance 
performance options necessary to achieve a 48 month fuel cycle was produced. The 
methodology was applied at an operating Westinghouse Pressurized Water Reactor to 
demonstrate the viability of a 48 month cycle within the nuclear industry. Of the 3108 
regulatory and investment protection surveillances studied, 3054 would likely support an 
extended fuel cycle. Initial recommendations are provided for resolving the remaining 54 
surveillances which are potential barriers to an extended cycle. The framework for 
reducing forced outage rates was applied to a key plant component, the Main Feed Pump. 
The framework concluded that the Main Feed Pump 1s likely to operate reliably over 48 
months and not have a significant impact on the overall plant forced outage rate. 

One of the key concepts discussed 1s the use of the Limiting Plant Event Frequency 
(LPEF) as a measure of expected loss in making surveillance program economic decisions. 
The LPEF includes the Core Damage Frequency (CDF), but also recognizes the 
importance of other transient endstates not affecting CDF whose economic consequences 
are so severe that they must be avoided with the same urgency applied to core damage. 
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Chapter 1 - Introduction 


1.1 Impetus 


Heading into the 21st century, the nuclear power industry is at an important 
crossroads. Faced with increasing competition from the coal and gas industries and a 
much stricter regulatory environment, the nuclear industry must focus on strategies that 
will improve its economic performance and make it an attractive alternative to other major 
electric power producing options. Only by pursuing these strategies will the nuclear 


industry guarantee its short term survival and position itself for long term growth. 


Conventionally fueled power plants start with an immediate economic advantage 
over nuclear plants because of lower construction costs and interest payments, lack of up 
front decommissioning costs, less regulatory costs, and typically much smaller plant 
staffing levels. To offset these built in economic advantages the nuclear industry must 
maximize its one clear advantage over all its major electric power producing competitors, 
significantly lower fuel costs. Once on-line, a nuclear power plant’s lower fuel costs can 
give it a decided economic advantage over other electric power producing options if the 
number of operating or on-line days significantly outnumber the number of days shutdown 


and it operates at full capacity. 


The term typically used to measure the economic performance of nuclear power 
plants is capacity factor. Capacity factor is defined as the amount of electricity produced 
over a given time period divided by the amount of electricity which could have been 
produced if the plant had run at 100% power for the entire period. Since nuclear power 
plants rarely operate at power levels much below 100% power, the major determinant in 
capacity factor increases is the ratio of on-line days to the sum of on-line and off-line days 
during any given time period. Off-line days are caused by either forced or planned 
outages. Forced outages result from either plant system failures or operator errors. 


Planned outages are used to perform refueling operations, preventative and corrective 
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maintenance, and svstem testing. Thus, any strategy designed to improve plant capacity 
factors, and hence economic performance, must focus on maximizing the number of on- 
line days during anv given time period. This can be accomplished by focusing on three key 


areas. These are: 

e Increasing the cycle length between refuelings 

e Minimizing refueling and planned maintenance outages times 
e Reducing forced outage rates 


The U.S. nuclear industry has already realized some of the potential economic 
gains from longer operating cycles. While most plants operated on fuel cycles as short as 
12 months just a decade ago, most now operate on an 18 month fuel cycle and 
approximately 17% of the industry has made or is now making the transition to 24 month 
fuel cycles. The rationale for extending to a 24 month cycle has been both the 
improvement in lifetime capacity factors and the elimination of one refueling outage every 
six years as compared to an 18 month cycle. Although there remains some skepticism 
within the industry as to the economic benefits of adopting a 24 month cycle, it is apparent 
that, despite some initial setbacks caused primarily by not anticipating all the possible 
problems associated with cycle length extension, 24 month fuel cycles are cost effective. 
Seabrook Station, for example, estimates a net savings of $29 million over a six year 
period by transitioning from an 18 month to a 24 month operating cycle. Of this total 


savings, $25 million comes from the elimination of one refueling outage every six years.’ 


Given the economic benefits already realized from increasing cycle lengths from 12 
months to 24 months, the next logical question is, are there even more economic benefits 
available by achieving even longer cycle lengths on the order of 48 months or more? This 
hypothesis was tested by Dalporto/Todreas in their work entitled “Achieving Higher 
Capacity Factors in Nuclear Power Plants Through Longer Operating Cycles” (MIT- 


ANP-TR-030). This research combined extensive interviews with industry leaders with a 


' O’Regan, Patrick J.. 24 Month Fuel Cycle Evaluation, December 1994. 
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simplified economic analysis. It concluded that the potential benefits to the U.S. nuclear 
industry from longer operating cycles were significant and provided a general strategy for 
how cycle lengths of this magnitude might be achieved. Given a 35 day refueling outage 
(already achieved by the best performing plants), the maximum theoretical capacity factor 


for various cycle lengths, assuming no forced outages, would be as shown in Table 1.1. 


Capacity Factor Potential Given a 35 Day Refueling Outage 


Table 1 - 1 
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Given that each 1% increase in capacity factor results in an approximate economic 









benefit of $2.19 million/year (based on $0.6 million per effective full power day), research 


efforts to develop a comprehensive strategy for obtaining a 48 month fuel cycle are clearly 


warranted. 
Such a strategy should address the following areas: 


e Core Design Issues. A fuel core should be designed which is capable of a nominal 48 
month lifetime. For practicality, it should fit into existing nuclear power plants and the 


fuel burnup should be maintained at or below current licensing limits. 
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e Required Reliability and Availability Performance. A strategy for attaining the plant 
levels of reliability and availability needed to reduce forced outages and make a 48 


month operating cycle economically attractive should be formulated. 


e Surveillance Requirements. All maintenance and testing activities, termed 
surveillances, which a utility is currently required to perform off-line at intervals less 
than 48 months must be made consistent with a 48 month cycle. Resolution can be in 
one of three forms: the surveillance’s performance interval can be extended to at least 
48 months, the surveillance’s performance mode can be changed from off-line to on- 


line performance, or in some cases, the surveillance can be eliminated. 


This thesis focuses almost exclusively on the development of a strategy to establish 
surveillance requirements which support a 48 month operating cycle in commercial 
Pressurized Water Reactors (PWR). An initial investigation into the reliability of one key 
PWR component (the Main Feed Pump), and its possible impact 48 month cycle forced 
outage rates is begun as the groundwork for more extensive future work on industry 


forced outage rates. 


1.2 Goals and Objectives 


Important untested speculations against extended fuel cycles have always included 
a perception that the regulatory and economic barriers to making the required regulatory 
based and investment protection surveillances compatible with longer operating cycles 
were just too difficult to overcome, the inability of plant equipment to run for extended 
periods of time between maintenance, and the economic costs associated with a longer 
core life. But, the first two arguments have never been thoroughly investigated. Ifthe 
surveillance requirements can be adjusted to allow longer operating cycles, and equipment 
can be operated with reduced forced outage rates over a 48 month cycle, the financial 
penalties of operating a longer life core could be outweighed by the economic gains 
associated with the increased plant capacity factor. In order to test this hypothesis, the 


following primary goals and objectives have been developed: 
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e Overcome the regulatory and investment protection barriers to extended cycle lengths 


e Provide a systematic surveillance resolution procedure that utilities can use to prepare 


for extended cycle lengths 


e Develop.an initial framework for a key plant component to show how key plant 
components can operate for extended periods of time between maintenance without 


adversely impacting the plant forced outage rate. 


1.2.1 Overcoming Regulatory and Investment Protection Barriers 


Too often in the beginning phases of this work, and during Dalporto/Todreas’s 
initial exploration of the possibility of extended cycle lengths, nucleaer industry personnel 
stated that they thought that the performance schedule of most of the surveillances they 
performed could be adjusted to support extended cycle length operations. But, they also 
stated that the regulatory barriers, imposed by the Nuclear Regulatory Commission 
(NRC) and other state and local agencies, that had to be overcome to move towards an 
extended cycle were just too difficult to change and thus did not warrant attempting cycle 
lengths beyond the current maximum of 24 months. One utility executive, from a very 
successful plant already using a 24 month fuel cycle, explained that he felt that many 
utilities were using the regulatory barriers as an excuse not to pursue longer cycle lengths, 
because they found the work necessary to get there “just too hard.” His experience, 
however, was that if one were willing to do the work necessary to provide a sound 
engineering and technical basis for requests to the NRC, the perceived barriers could be 
overcome. This experience was backed up by comments received in interviews conducted 
with senior NRC management about the 48 month cycle who reiterated the fact that 
although they thought it would be difficult, extended fuel cycles were possible and that 
regulatory concerns could be satisfactorily resolved if the proper technical case could be 


made. 


Chapter 2 of this report presents a methodology for identifying the surveillance 


performance options necessary to overcome the regulatory and investment protection 
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barriers to a 48 month operating cycle. The methodology can be applied to each 
surveillance which currently precludes a 48 month cycle. A decision chart identifies the 
possibilities for resolution with an extended fuel cycle. The methodology yields a 
recommendation that the particular surveillance is either a candidate for on-line 
performance (Category A), a candidate for performance interval extension (Category B), 
or a potential impediment to a 48 month fuel cycle which requires further study (Category 
C). Chapter 3 shows how this methodology could be applied to resolve the entire set of 
PWR plant surveillances to a 48 month cycle by using the actual surveillance program 


from an operating PWR. 


An area of study that should be developed in the future is the optimization of 
surveillance categorization. The methodology of Chapter 2 identifies the surveillance 
performance possibilities for those surveillances currently precluding a 48 month fuel 
cycle. Some surveillances will be candidates for both on-line performance or off-line 
performance at extended intervals. For surveillances meeting these criteria, a decision 
must be made as to the optimum choice. A project to develop a model that could choose 
the best option for each surveillance to maximize the economic benefits of this entire set of 


surveillances (given no overall change in plant risk) should be considered. 


1.2.2 Providing a Procedure for Utilities 


After developing a methodology for overcoming the regulatory and investment 
protection barriers, the thesis demonstrates that the blueprint approach laid out in the 
Surveillance Resolution Methodology in Chapter 2 is viable and provides a procedure for 
utilities to apply to their entire surveillance package. Chapter 3 answers the question, 
“What kind of results can a typical PWR expect if an extensive “48 Month Fuel Cycle 
Surveillance Resolution Study’ is carried out?” The regulatory and investment protection 
surveillance requirements of an operating PWR transitioning to a 24 month cycle were 


analyzed. Utilizing the methodology presented in Chapter 2 as a framework, surveillance 
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performance procedures and historical surveillance records were used to identify possible 
candidates for on-line performance (Category A), off-line performance at 48 month 
intervals (Category B), and those surveillances which are likely to preclude a 48 month 
cycle and require further study (Category C). Plant personnel were consulted to ensure 
surveillance classifications were appropriate. Ultimately, expert judgment was relied upon 
to assign final individual surveillance categorizations. Chapter 4 compiles all the 
surveillances placed in Category C. Some discussion of the possible solutions to these 


surveillances 1s provided. 


As part of the detailed surveillance resolution procedure, Appendix A provides 
detailed instructions for completion of technical evaluations necessary to support 
surveillance performance interval extension. Additionally, Chapter 5 provides an interval 
extension justification that was used as the basis for an actual 24 month interval extension 
request at the candidate PWR. The format of this example provides a general guide to 
utilities for how to justify a surveillance’s performance interval extension. By presenting 
an interval extension justification, Chapter 5 illustrates the effort required to complete a 48 
month fuel cycle surveillance resolution project. For this thesis, complete justification of 
all candidate surveillances was a prohibitively large task. Also, it was assumed that actual 
surveillance resolutions will vary somewhat from plant to plant. Consequently, complete 


surveillance justification is left to the individual utility. 


Finally, Chapter 7 is a compilation of management principles and engineering 
points of interest related to an extended fuel cycle. It answers the question, “What are 
some of the major management and engineering issues which should be kept in mind when 
pursuing surveillance requirement resolution?” Topics discussed include on-line 
surveillance scheduling aids, methods of transition to an extended cycle, mid-cycle 


maintenance outages, and others. 
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1.2.3 Initial Framework for Reducing Forced Outage Rates 


Chapter 6 investigates the reliability levels of the Main Feed Pump (MFP) and its 
impact on plant forced outage rates. Industry data was compiled to provide an estimate of 
the current reliability levels. Additional research and interviews with industry 
representatives, pump vendors, pump consultants, and the vendors of key pump sub- 
components was conducted to determine the major failure mechanisms, root causes of 
failure, and recommendations for improving the reliability of the MFP. The primary 
purpose of Chapter 6 was to develop a framework for use in making decisions on whether 
key plant components could economically be made to operate reliably for 48 months 
without adversely impacting the overall plant forced outage rate. Chapter 6 lays the 
groundwork for significant future work on other key plant components that are major 


contributors to the overall plant forced outage rate. 


1.3 Safe Performance versus Economic Performance 


There is common misconception by some within the nuclear industry that by 
emphasizing economic performance, one sacrifices safety and vice versa. A close look at 
industry performance measures in the past decade helps break that paradigm. Following 
the Three Mile Island accident in 1979 there was an enormous increase in the regulation 
and oversight of the nuclear industry. An even higher emphasis was placed on safe 
operation in an attempt to regain credibility and public confidence. Yet, despite the 
increased emphasis placed on safe operation, which on the surface might appear to conflict 
with what is needed to improve plant economic performance, the industry has seen an 
unprecedented rise in the average plant availability (a measure of economic performance) 
in the last decade while at the same time the average number of automatic scrams and 
significant events per plant (measures of safe performance) have dropped significantly. 


This data, provided by the NRC, is shown in figure 1.1. 
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Figure 1.1 validates the hypothesis that as the industry has become safer, as 
indicated by the lower number of significant events, the better the plants perform, as 
indicated by both the reduced number of automatic scrams and the increase in availability. 
Assuming that the average power plant earns about $600,000 per effective full power day, 
the 11.4% increase in availability in 1994 as compared to 1986 resulted in $24.98 million 
in additional revenue in 1994 alone. The total savings from 1986 to 1994 were $110.45 
million. In an industry struggling to maintain its viability into the next century this is a 
significant amount of additional revenue which can either be returned to investors as 


dividends or to the end users in the form of lower electric rates. 


1.4 Terminology 


The author has attempted as much as possible to use terminology that is standard 
within the nuclear industry. For clarity, the following terms are defined here. 
e Surveillance - A planned maintenance or test performed to meet either regulatory 
requirements or for investment protection purposes. 
e Investment Protection - A class of surveillance, voluntarily performed by a utility to 
protect components or systems vital to plant operation, in which they have invested 


significant amounts of capital. 
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e Performance Mode - The standard technical specification definitions which describe 


reactor state in terms of power and temperature. The defined modes are: 


Mode 1 
Mode 2 
Mode 3 
Mode 4 
Mode 5 
Mode 6 


Critical (> 5% Power) >350°F 
Critical (<5% Power) >350°F 


Shutdown >350°F 
Shutdown 200-350°F 
Shutdown <200°F 
Refueling <140°F 
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Chapter 2 - Surveillance Resolution Methodology 


2.1. Introduction 


Some of the methodology presented in this chapter was developed jointly between 
myself and John Maurer who worked concurrently on a similiar thesis titled “Surveillance 
Strategy for a Four Year Operating Cycle in Commercial Boiling Water Reactors.”, 
February 1996. The joint work was conducted for the MIT Extended Fuel Cycle Project 
team under the ausipices of the MIT Program for Advanced Nuclear Power Studies. The 
results of this work are presented in report MIT-ANP-TR-036 titled “Surveillance 
Strategy for a Four-Year Operating Cycle in Commerical Nuclear Reactors”, May 1996. I 
footnote the portions of this chapter which were developed individually by Maurer. 

The term ‘surveillance’ is broad in scope. As used in this report, it defines a 
variety of component tests, inspections, overhauls, and preventive maintenance activities. 
For example, surveillances include diesel generator operability tests, accumulator integrity 
inspections, electrical breaker overhauls, and valve internals preventive maintenance 
activities. A typical nuclear power plant may conduct more than one thousand different 
surveillances per fuel cycle. | | 

In order to achieve a four year fuel cycle, the performance mode or the 
performance interval of all plant surveillances performed at intervals less than 48 months 
while the reactor is shutdown must be resolved. There are two fundamental ways a 
surveillance can be conducted to support a 48 month operating cycle. The surveillance 
can be performed while the plant is at power or the surveillance performance interval can 


be extended to at least 48 months. 


This chapter discusses these two surveillance resolution paths in depth and 
presents a methodology for determining the resolution options a plant has for its individual 
surveillances. The methodology is presented in the form of two flowcharts. The 
flowcharts lead to a recommendation for each surveillance. The recommended categories 


are the following: 
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e Candidate for on-line performance 

e Candidate for performance interval extension, 

e Candidate for either on-line performance or interval extension, or 
e Requires further study 


The chapter then proposes an optimization model for those surveillances which can 
be performed either on-line or at extended intervals. This model would provide as an 
output the most economic combination of surveillance performance modes and 
surveillance performance intervals for the entire set of surveillances while maintaining 


plant risk levels unchanged. 


2.2. Surveillance Resolution Options 


2.2.1 Definitions 


_ For the purposes of this thesis, surveillances will be placed in one of three 
categories which define their probable compatibility with a 48 month fuel cycle. The 


categories are defined as follows: 
Category A - Surveillances which are candidates for on-line performance. 


Category B - Surveillances which are candidates for performance interval 


extension to 48 months. 


Category C - Surveillances which are possible barriers to a 48 month cycle and 
require further engineering assessment to determine whether compatibility with a 


48 month fuel cycle can be accomplished 


2.2.2 Category A - On-Line Surveillance Performance 
During the 1980’s, the U.S. nuclear industry began a concerted effort to reduce 
the length of refueling outages. The driving force was the economic benefit from 


returning plants to an operational status as.soon as possible. Lost revenues from outage 











days in the nuclear industry range from $500,000 per day to over $1,000,000 per day for 
utilities where nuclear capacity is less than or equal to demand. Given the loss of revenue, 


efforts to reduce outage length by even a few hours 1s justifiable. 


The first mechanism used to achieve shorter refuel outages was improved outage 
planning. Outage efficiency was improved by maximizing the number of surveillances 


performed simultaneously, thus reducing the total amount of time the plant was off-line. 


Once outage efficiency was improved, plant managers focused their attention on 
moving surveillances to on-line performance modes. This resulted in a substantial increase 
in the number of surveillances performed on-line and has been the focus of reviews by 


many major nuclear power organizations, including the Nuclear Regulatory Commission? 


(NRC). 


Besides economics, there are many other advantages to increased on-line 
surveillance performance besides reduced outage lengths. These include the greater 
attention which can be afforded surveillances performed on-line, a leveled workload over 
the course of an operating cycle, and labor cost reductions from the more efficient use of 
full-time employees rather than more expensive outside contractors. These and other 


factors are discussed below. 


Utilities should analyze the on-line performance possibilities of all surveillances, 
even those which are not part of the outage’s critical path. While justifying a surveillance 
for on-line performance may not result in a direct refueling outage length reduction, it may 
shorten the outage indirectly by freeing up time for emergent maintenance which often 


becomes the critical path during refueling outages 


During refueling outages, the number of tasks performed and the increased 
manning levels generate a degree of fatigue and complexity not experienced during normal 
plant operations. Senior engineering oversight gets stretched thin when so many people 


are performing so many different activities at once. In contrast, on-line surveillance 


* “Fyvaluation of On-Line Maintenance”, Temporary Instruction 2515/126, Nuclear Regulatory 


Commission, 27 October 94. 
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performance can be afforded much more oversight and planning. Consequently, on-line 
surveillance performance may result in higher quality maintenance and more precise test 
execution. However, on-line maintenance can also increase the risk of plant trips and 


transients if poor maintenance practices are not corrected. 


Another human factor advantage associated with performing a surveillance on-line 
is the increased probability of it being performed by full-time plant employees rather than 
more expensive outside contractors. The magnitude of the work to be done during a 
refueling outage and the incentive to minimize the outage length means that outside 
contractors are often hired to perform a significant portion of the surveillances during an 
outage. Ifa surveillance can be performed on-line, the relatively light daily plant workload 
facilitates surveillance performance by full-time plant personnel. This results in two direct 
benefits. The first is the increased attention afforded the surveillance which is likely since 
the plant employee has an ownership stake in the day to day performance of the 
component or system. The second direct benefit resulting from surveillance performance 
by plant personnel is increased component and tasking familiarity. Reading the report of a 
surveillance performed by a contractor can only communicate a certain degree of 
component status. Having someone on-site everyday who performed the latest diagnostic 
checks of a component and is intimately aware of the results of those checks is extremely 
valuable. Such a person is more likely to understand potential failure mechanisms and 


remember trends in component performance. 


Along with advantages in human factors from performing a surveillance on-line, 
some surveillances are simply safer to do while the plant is operating. For example, from 
a risk standpoint, the Residual Heat Removal (RHR) System plays a larger safety role 
when the plant is being shutdown then when it is on the line. Therefore, surveillances 
which require the RHR system to be inoperable are safer from a risk standpoint to perform 
on-line. In the case of the RHR system, performing the applicable surveillances during an 
outage could limit the plant’s ability to successfully cope with a Loss of Cooling Accident 


(LOCA) and raise the core damage frequency (CDF). 
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Another incentive for justifying surveillance on-line performance ts that the 
surveillance performance frequency can be increased if required. If a component 
demonstrates poor performance. non-intrusive surveillance performance may assist in 
predicting component failure. Failure mechanisms can then be diagnosed and corrected 
before catastrophic component failure occurs. In this way, on-line surveillance 
performance provides an enhanced component monitoring capability. This monitoring 
capability may ultimately result in improved equipment performance. If preventive 
maintenance and diagnostic checks can be performed whenever a problem ts suspected 
rather than at set intervals (dictated by the refueling outages), then problems can be 
avoided. Fewer catastrophic failures can extend component life. For example, if the oil 
can be changed on-line whenever a motor exceeds a certain amount of run time rather than 


at set calendar intervals the motor will likely last longer. 


While there are many advantages to on-line surveillance performance, it is not risk 
free. The safety and economic impacts of taking systems out of service for surveillance 
performance must be carefully considered prior to any on-line work. On-line, Probabilistic 
Risk Assessment (PRA) based risk monitors can play an important role in pre-surveillance 
planning. They greatly enhance a surveillance scheduler’s ability to identify potentially 
hazardous system configurations. However, they do not consider economic risks from on- 
line surveillance performance. Nor are they are substitutes for thorough preparation and 
training of the workers who will actually be performing the surveillance. Senior 
management must ensure that everyone involved in on-line surveillance performance 
understands the possible complications of the proposed work. Surveillance performance 
can often have a significant effect on other seemingly independent equipment. For 
example, many instrument calibrations are fairly routine when they are performed during 
an Outage. But, if they are performed on-line, simply valving an instrument in and out of 
the system can cause potentially dangerous fluctuations in other instruments monitoring 
vital plant parameters. Workers must thoroughly understand critical system 
interdependencies such as these when they perform any surveillance during power 


operations. 
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2.2.3 Category B - Performance Interval Extension 


During the early years of the nuclear power industry, plant engineers had very little 
Operating experience upon which to base component reliability judgments. Consequently, 
!1t was not unusual for plants to shutdown every few months to test vital systems. While 
the industry has progressed beyond this ‘test to see if it’s broke’ mentality, many current 
surveillance intervals are still indirectly a consequence of that reasoning. Intervals started 
out short and have been gradually extended to meet plant requirements, not necessarily as 
determined by component performance. Consequently, many performance intervals have 
not been optimized. Instead, they have been chosen so that they meet two conditions; 
one, that they are conservative, and two, that they support the current plant operating 
_ cycle length. This second condition is evident in the non-quantitative surveillance 
performance extension requirements mandated by NRC Generic Letter 91-04 for utilities 
going from 18 to 24 month fuel cycles. Extension requests rely on expert opinion and 
historical surveillance data to make the case that a surveillance interval can be safely 
extended. This method is chosen because no quantitative methodology for optimizing 
performance intervals currently exists. An optimization methodology will facilitate 
justifying the extension of performance intervals for surveillances which currently have 
overly conservative performance intervals. If a component has been in service for a 
significant period and has never failed or been found out of specification, it is reasonable 
to question the whether the performance interval can be increased. Surveillance 
performance requires time and labor. Resources are poorly allocated if they go toward 


over-testing a proven component. Frequent testing can also result in equipment wear-out. 


Another new maintenance approach which will aid in interval extension 
justifications is event-based (instead of time-based) testing. Event based testing is a subset 
of performance based testing which is widely regarded within the industry as the wave of 
the future in maintenance strategies. The theory is that if failure mechanisms are 
predominantly event-dependent rather than time-dependent, a correlation between the 


events in a component’s life such as motor start-up and the required surveillance 
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performance interval can be determined. The result would be surveillance testing 


mandated every X motor starts or valve strokes instead of every Y months or years. 


2.3. Surveillance Resolution 


This section presents a surveillance resolution procedure. This procedure provides 
a systematic method for determining the resolution options for individual surveillances. 
Once the various options are identified for each surveillance requirement, a proposed 
Economic Optimization Model would determine the most economical combination of 
performance modes for all the surveillances while maintaining current plant risk levels 
unchanged. The risks involved include those associated with core damage as well as other 
undesirable economic end-states such as the need for emergency depressurization in a 
boiling water reactor or feed-and-bleed in a pressurized water reactor. Both types of risks 
will be analyzed by the Economic Optimization Model. The goals of the Economic 


Optimization Model will be to provide a surveillance program that will: 
e Provide maximum economic benefit 
e Inthe worst case, be risk neutral 
e Support a future U.S. nuclear industry goal of 30 day planned outages 
® Suppor a future U.S. nuclear industry goal of 40 forced outage days per cycle 


e Minimize the number required of mid-cycle maintenance shutdowns, with a 


goal of zero shutdowns 


2.3.1. Category A Resolution Flowchart 


This section discusses how to decide whether on-line surveillance performance 1s 
possible. In order to accomplish this, refer to the Category A Resolution Flowchart in 
Figure 2.2 (a flowchart legend is provided in Figure 2.1). Within this flowchart, the 
Boolean variable ‘A’ represents the event that the surveillance can be performed on-line. 


If A = True, then the surveillance is a candidate for on-line performance. If A = False, 
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then the surveillance is not a candidate for on-line performance and other options must be 


investigated. 


The various decisions and processes of the Category A Resolution Flowchart are 


discussed in more detail below: 
© Can the surveillance be eliminated? 


This is a fundamental issue independent of whether the surveillance falls into 
Category A or B. If performance of the surveillance has no effect on plant safety 
or reliability, then the surveillance should be eliminated. Additionally, if 
surveillance performance has only a small effect on plant safety or economic 
performance and could be compensated for by increasing the frequency of selected 
on-line surveillances, it may be possible to eliminate the surveillance with no net 


effect on the overall CDF or economic performance. 
QO Is the component accessible at power? 


If a component is not accessible at power either directly or remotely, modifications 
have to be to made to permit access or the surveillance has to be performed 
shutdown. Inaccessible equipment includes any components inside the bio-shield 
or located below the reactor and may also include components that are located in 
high radiation areas where excess personnel exposure costs may make on-line 


performance cost prohibitive. 
® Can modifications be made to render the component accessible? 


If such modifications are not possible, then the applicable surveillance cannot be 
performed on-line, A = False, and surveillance resolution analysis should proceed 


to the Category B Resolution Flowchart which 1s discussed later. 
© Can the surveillance be performed on-line by procedure? 


If an on-line performance option already exists in the current surveillance 
procedure, then a determination must be made as to why the utility currently 


chooses to perform the surveillance off-line. This could include reasons ranging 
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from economic cost, a perceived risk of operator errors causing unplanned 
shutdowns, increased man-rem exposure, or no current incentive to perform the 
surveillance on-line given current plant cycle and refueling lengths. Whatever the 
reason, action would have to be taken to ensure that on-line surveillance 
performance does not constitute an unjustified risk. The risk issue is addressed in 


the Economic Optimization Model later in this chapter. 
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> Maurer, John H. “Surveillance Strategy for a Four Yeare Operating Cycle in Commercial Boiling Water 


Reactors.” MIT Master of Science in Nuclear Engineering Thesis, February 1996 , p. 26. 
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0 Is the component more risk significant at shutdown? 


Most components/systems which would fall into this category are shutdown safety 
systems such as the RHR system. In many instances, it would be more desirable to 
test the system on-line to confirm its operability than to wait for a shutdown 


condition when its use may be essential. 


QO Can the surveillance be performed in a Limiting Condition of Operation (LCO)? 





LCO’s are plant configurations, involving the unavailability of a particular 
component or system, which are allowed for short periods of time by the plant 
technical specifications. The purpose of an LCO is to minimize unnecessary 
shutdowns in instances where components or systems can be safely tested on-line 
and quickly restored to service. In the past, the NRC’s position was that LCO’s 
were only to be used for the performance of corrective maintenance. The NRC 
now allows utilities to enter LCO’s in order to perform surveillances on-line 
provided the utility demonstrates an acceptable understanding of the risks 
associated with on-line performance and can perform the surveillance within an 
allowed outage time (AOT). Most utilities have a self imposed time to perform 
on-line surveillances of 1/2 to 3/4 of the AOT to prevent having to enter an action 


statement which may mandate a plant shutdown.. 


QO Are on-line testing substitutes available? 


On-line testing methods such as radiography or ultrasonic testing may provide an 
alternative to many of the open and inspect surveillances resulting from the 
American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel 
Code Section XJ. Other testing substitutes could include vibration analysis, 


thermography, or state of the art lube oil analysis programs. 


Is redundant equipment available? 





If redundant equipment is available, the component or system can likely be 
removed from service within an LCO and the surveillance performed on-line. This 


is particularly applicable to instrumentation where two or more measurement 
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channels for each parameter are provided. For example. the improved 
Westinghouse Standard Technical Specifications approved by the NRC specifically 
allow the removal from service of a redundant channel on reactor protective 


systems for up to four hours for maintenance or calibration. 
© Can redundant equipment be added? 


The answer to this question depends not only on the component and its function, 
but also on the layout and space availability of the plant. The cost of adding 
redundancy is also a prime consideration. Many utility executives interviewed for 
this report indicated that a utility must be very confident that it will see a return on 
investment in the first three to four years following major plant modifications 


before it will make the up front investment required to make the modifications. 


If the answer to any of the last six questions above is yes, then A = True and the 
surveillance is a candidate for on-line surveillance. Ifthe answer to all of the last six 


questions above is no, then A = False and on-line performance is not an option. 


Regardless of whether A = True or False, the next step 1s to determine whether the 
surveillance is a candidate for performance interval extension. The Category B Resolution 


Flowchart is used to make this determination.. 


2.3.2. Category B Resolution Flowchart 


The next resolution task is to decide whether a surveillance ts a candidate for 
performance interval extension. The Category B Resolution Flowchart in Figure 2.3 is 
used to make this determination. Within this flowchart, the Boolean variable ‘B’ 
represents the event that the surveillance performance interval can be extended. IfB = 
True, then the surveillance is a candidate for performance interval extension. If B = False, 
then the surveillance performance interval cannot be extended. The Boolean variable ‘C’ 
represents the event that the surveillance performance interval cannot be extended and the 


surveillance cannot be performed on-line. C = True if A = False and B = False. IfC = 
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True, then the surveillance requires further study to make it compatible with a 48 month 


operating cycle. 


The various decisions and processes of the Category B Resolution Flowchart are 


discussed below. 





© Can the interval be extended on the basis of a technical evaluation? 


This will be the primary method for justifying extensions of surveillance 
performance intervals. NRC Generic Letter 91-04 forms the basis for the technical 
evaluation. The evaluation must consider issues such as surveillance history, 
corrective maintenance history, preventive maintenance history, time dependent 
failure modes, and system engineer technical opinions. If the technical evaluation 
concludes that the surveillance performance interval can be safely extended, then B 
= True and resolution analysis should proceed to the Economic Optimization 


Model. 
© Can the interval be extended based on a lack of risk significance? 


If extending the performance interval of a particular surveillance has a relatively 
small impact on the overall CDF or economic performance, then its interval can 
likely be extended. The increase in CDF or the increased economic cost as a result 
of performance interval extension could be offset by additional on-line testing of 


other surveillances. 
© Can the interval be extended by increasing the scope of the surveillance? 


If the scope of a surveillance is increased, it may be possible to perform it on a less 
frequent basis. For example, a particular pump is completely overhauled every 10 
years, but an inspection is performed every 24 months while the plant is shutdown. 
However, if the pump’s material history showed that time dependent failures only 
occurred at frequencies approaching 10 years, than the pump components with the 


highest time dependent failure rates could be replaced on a more frequent basis 
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than once every 10 years, allowing the plant to justify extending the inspection 


interval for the pump to coincide with the replacement of these components. 


Can the interval be extended by performing on-line monitoring? 


On-line monitoring programs are increasing in use and sophistication. Some of the 
current on-line monitoring programs include techniques such as vibration analysis 
of pumps and turbines, acoustic flow detection and monitoring to measure valve 
performance, radiography, thermography of breakers and pumps, and lube oil 
analysis. The application of these techniques may allow for actual inspection 
intervals to be extended. This has the added benefit of reducing the number of 
times a component must be taken apart for inspection thus introducing more 


human error into the overall component performance. 


© Can the interval be extended by upgrading the component? 


Many surveillance performance intervals are based on the failure history of 
particular components. Ifa superior component or system exists, performance 
interval extension might be possible by replacing the existing component with the 
superior performer. Upgrades of components could also entail more elaborate 
installation and alignment techniques. For example, many pump failures are due to 
improper or insufficiently precise alignments. An improvement in the alignment of 
the shaft through the use of a modern alignment technique and proper mounting of 
the pump could result in improved component performance and reliability which 


would justify a surveillance performance interval extension. 


If the answer to any of the last four questions above is yes, then B = True and the 


surveillance is a candidate for performance interval extension. 


If the answer to all of the last four question above 1s no, then B = False and the 


surveillance cannot be performed at extended intervals. 
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if A = False and B = False, then the surveillance 1s classified as Category C and 
requires further study to resolve it consistent with an extended operating cycle. All other 


surveillances are input into the economic optimization model. 


2.3.3. Economic Optimization Model 


The purpose of the Economic Optimization Model, represented in the flowchart of 
Figure 2.4, is to identify the various surveillance performance variables needed for the 
proposed Economic Optimization Engine which will be discussed later in the chapter. 
These variables are required for the Engine to determine the most economic combination 
of surveillance performance modes while maintaining current risk levels. Variable 
determination is accomplished in the process boxes of the Economic Optimization Model. 
(The specific quantification methods for determination of the variables is left as future 
work. ). 

Maintaining current risk levels unchanged involves accounting for changes in the 
probability of core damage as well as other undesirable economic end-states. Limiting 
Plant Events (LPE), which are events that have a significant economic impact on the plant, 
define the entire set of risks which must be controlled to achieve economic success. In the 
past, CDF has been the risk indicator most frequently used by the nuclear industry for 
making maintenance and operational decisions. Yet, the sole use of CDF in determining 
plant risk levels does not adequately account for all the important risk considerations. 
Core damage must obviously be avoided because of the possible consequences to public 
health and safety. But, core damage must also be avoided because it results in a 
significant economic impact on the plant, and likely the entire nuclear industry. Therefore, 
in reality, core damage is a subset of the entire set of LPE’s that have a significant 
economic impact on a plant. Since the rationale behind any length fuel cycle extension 
program is improved economic performance, the Limiting Plant Event Frequency (LPEF) 
is the critical factor that must be considered in any surveillance resolution program. Any 
Economic Optimization Engine must consider all the possible endstates that could lead to 


a LPE. These would include but are not limited to: 
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e Any endstate resulting in damage to the Main Turbine or Generator which would 


require lifting of the turbine casing or generator winding replacement 


e Any endstate resulting in severe damage to a Main Feed Pump requiring pump or 


turbine end replacement 


e Any endstate resulting in damage to a Reactor Coolant Pump where the reactor 1s 


safely shutdown but loop draining is required to remove and repair the pump 


e Any endstate resulting ina BWR reactor depressurization trip with resulting 


containment contamination 
e Any endstate resulting in core damage 


In only the last case is core damage an endstate. However, the time required to 
make the repairs necessary to return the plant to an electric producing (and revenue 
generating) state in the first four cases is so lengthy and costly, that occurrence of these 
types of endstates must be avoided with almost the same urgency applied to core damage. 
Because LPE’s are most likely to occur as the result of a major plant transient, their 
probability of occurrence is likely highest when the plant is at power. Significantly, LPE’s 
may involve systems not included in the technical specifications. While methods to 
determine changes in CDF have received widespread study and are fairly well understood, 
LPEF changes have not received the same focus and require more in-depth study to 


determine how to quantify changes in the LPEF. 


Two restraints on the output of the Economic Optimization Engine would be that 
the mean and extreme LPEF and CDF over the course of the cycle would be no worse 
than unchanged as compared to the original cycle length values.* Although the events 
contributing to the mean LPEF value include those affecting the mean CDF value, it is 
possible that improvements in the frequency of other LPE's could mask a large increase in 


the CDF. Therefore, from a pure safety standpoint, a constraint must also be placed on 


* Note that if a percentage decrease or increase in either the integrated LPEF or CDF was required or 


desired, the Engine could be easily modified to provide this. 
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the changes in the mean CDF. Another requirement would be that the Engine’s 
recommendations do not contradict the appropriate legal authority, 1.e. technical 
specifications or other legal code. Finally, a limit would be placed on both the 
instantaneous LPEF and CDF which could be experienced by the plant so that dangerous 


plant configurations would be avoided. 


In the descriptions below, variables are classified as either “given” or “input”. A 
“given” variable concerns a surveillance which has only one possible means of resolution 
within a 48 month operating cycle. An “input” variable concerns a surveillance which has 


more than one possible means of resolution within a 48 month operating cycle. 


A detailed description of each process box: (the numbers in parentheses refer to 


the numbers next to the process boxes in Figure 2.4) follows. 
[1 (1) Determine the changes in LPEF and CDF from surveillance elimination 


The elimination of a surveillance may increase both or either of the LPEF and CDF 
of the plant. This increase might be offset by a decrease in the LPEF and/or CDF as a 
result of either a change in the performance mode or a change in the performance interval 
of some other surveillance. The changes in the LPEF and CDF as result of surveillance 
elimination 1s a “given” variable to the Economic Optimization Engine because no other 
performance option is considered for surveillance’s whose elimination results in large 
economic savings. Ultimately, the changes in the LPEF and CDF must be accounted for 


in the output of the Economic Optimization Engine. 
(J (2) Determine the changes in LPEF and CDF from switching to on-line performance 


Switching to on-line surveillance performance may change the LPEF and/or CDF. 
This change may be either an increase (as in the case where a plant transient resulting from 
human error may be more likely) or a decrease (as in the case where the surveillance 
involves a system or component which is more risk significant during shutdown). The 
changes in the LPEF and CDF from switching to on-line performance for A = True, B = 


False surveillances is a “given” variable to the Economic Optimization Engine because off- 
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line performance interval extension 1s not an option. Ultimately, the changes in the LPEF 


and CDF must be accounted for in the output of the Economic Optimization Engine. 
[J (3) Determine the changes in LPEF and CDF as a function of the performance interval 


When the performance mode of a surveillance is switched from off-line to on-line, 
increased surveillance performance frequencies become an option. Increasing 
performance frequencies, for non-destructive surveillances, may result in a decrease in the 
LPEF and/or CDF (as in the case where a preventive maintenance activity can be 
performed more frequently). This decrease in LPEF and CDF may be needed to offset a 
possible increase in LPEF or CDF resulting from changing the performance mode or 
performance interval of other surveillances. The changes in LPEF and CDF as a function 
of the performance interval for A = True, B = False surveillances is a “given” variable to 
the Economic Optimization Engine because off-line performance interval extension 1s not 
an option. The Economic Optimization Engine will recommend performance intervals for 
all A = True, B = False surveillances so that the total net changes in the LPEF and CDF 


are zero. 
[1 (4) Determine the changes in LPEF and CDF from extending the performance interval 


Extending the performance interval of a surveillances to make it compatible with a 
48 month fuel cycle may result in an increase in the LPEF and/or CDF (as in the case 
where the operation of an integral safety system will be verified less frequently). The 
changes in LPEF and CDF from surveillance performance interval extension for A = False, 
B = True surveillances is a “given” variable to the Economic Optimization Engine because 
on-line surveillance performance is not an option. Ultimately, the changes in the LPEF 


and CDF must be accounted for in the output of the Economic Optimization Engine. 
[} (5) Determine the time required to perform the surveillance 


During a refueling outage surveillances can be performed in parallel with refueling 
operations without any additional increase in outage length. It is assumed that utilities 
already employ parallel path surveillance planning tools to help minimize outage lengths. 


Once the core is completely refueled, however, surveillance performance generally 
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becomes the critical path towards outage completion. Consequently, surveillances 
performed after completing core refueling are extremely expensive. Therefore, the time 
required to perform a surveillance during an outage must be considered by the Economic 
Optimization Engine to determine the combination of surveillance performance modes 
which will minimize the number of surveillances performed after the core has been 


refueled. The time required to perform A = False, B = True surveillances is a “given” 


variable to the Economic Optimization Engine. 
(6) Determine the On-Line Performance Cost (Refer to Figure 2.5) 


If a surveillance can be made compatible with an extended operating cycle by 
either performing it on-line or extending the performance interval, a resolution decision 
must be made. A key variable in this decision is the cost of performing the surveillance 
on-line. Several of the factors which determine the cost of performing a surveillance on- 


line are discussed below. 
CI Labor/Exposure 


A surveillance which is simple to perform off-line may be extremely 
complex when performed at power. Extra surveillance preparation time may be 
required when performing a surveillance on-line because system interdependencies 
and contingencies must be considered. Actual surveillance performance may have 
to proceed at a slower than usual pace to ensure no mistakes are made which 
could cause a plant transient or reactor trip. Another potential drawback of on- 
line surveillance performance ts a possible increase in radiation exposure to plant 
personnel . (A figure of $10,000 per man-rem is the figure used at the plant where 
research was conducted.) Increased surveillance performance time and increased 


radiation exposure increase surveillance performance costs. 


(1 Modifications 


In order to perform some surveillances on-line it may be necessary to make 
modifications to the existing plant configuration or additions to the plant 


inventory. Changes may have to be made simply to gain access (directly or 
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remotely) to the component or system involved in the surveillance. Redundant 

equipment may have to be added so that the component or system to be tested can 
be taken out of service while the plant is at power. On-line testing equipment may 
have to be added to the plant’s inventory. Any changes to the plant configuration 


or additions to the plant inventory increase on-line performance cost. 
[1 Planning 


Extra planning for on-line surveillance performance including additional 
training of plant personnel will likely be required if a surveillance is performed on- 
line. Normal testing line-ups may have to be altered if a surveillance performance 
mode is changed from off-line to on-line. Such changes would require analysis by 
semor engineers. The planning and training required for on-line surveillance 


performance will increase the cost of the surveillance. 
[] Performance Frequency 


To maintain current risk levels when an extended fuel cycle is adopted, it 
may be necessary to perform on-line surveillances more frequently. If the 
frequency of surveillance performance increases, the cost associated with that 


surveillance increases proportionally. 


[J Plant Capacity 


To perform some surveillances on-line, a reduction in plant power may be 
required. For instance, some utilities perform on-line stroke testing of Main Steam 
Isolation Valves (MSIV’s) by reducing plant power during off-peak periods. 
Reduction of plant power results directly in loss of revenue, although the 
alternative, complete shutdown to perform, may be even more expensive. Many of 
the surveillances which require a reduction in plant power could likely be 


performed simultaneously, minimizing the loss of electricity production. 
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[] Licensing 


Changing the performance mode of some surveillances will require 
approval by the appropriate regulatory authority. The mode change justification 
packet will require analysis by support engineering. The time spent producing the 


analysis will be part of the on-line performance cost. 


The sum of these six cost factors yields the overall on-line surveillance 
performance cost. This on-line surveillance performance cost for A = True, B = True 
surveillances is an “input” variable because the alternative, extending the performance 
interval, is also an option. The Economic Optimization Engine will ultimately determine 


the performance mode. 


(} (7) Determine the changes in LPEF and CDF from switching to on-line performance 


If the surveillance is performed on-line the LPEF and/or CDF may change. The 
change may be in either an increase (as 1n the case where a system or component such as a 
Diesel Generator is removed from service for surveillance performance) or a decrease (as 
in the case where the surveillance involves a system or component which is most risk 
significant during shutdown). The changes in the LPEF and CDF from performing A = 


True, B = True surveillances on-line is an “input” variable to the Economic Optimization 


Engine because the alternative, extending the performance interval, is an option. The 


Economic Optimization Engine will ultimately determine the performance mode. 


(J (8) Determine the changes in LPEF and CDF as a function of the on-line performance 


interval 


If the surveillance is performed on-line, increased surveillance performance 
frequencies are an option. Increasing performance frequencies, as long as the surveillance 
itself is not a destructive examination of the component, may decrease the LPEF and/or 
CDE (as in the case where a preventive maintenance activity can be performed more 


frequently). The decrease in LPEF and/or CDF may be needed to offset the increases in 
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LPEF or CDF resulting from changing the performance mode or performance interval of 
other surveillances. The changes in LPEF and CDF as a function of the performance 
interval for A = True, B = True surveillances is an “input” variable to the Economic 
Optimization Engine because the alternative, extending the performance interval. is an 
option. The Economic Optimization Engine will ultimately determine the performance 


mode as well as the performance frequency (if on-line performance ts chosen). 
al (9) Determine the Extended Interval Performance Cost (Refer to Figure 2.5) 


If a surveillance can be made compatible with an extended operating cycle by 
either performing it on-line or extending the performance interval, a resolution decision 
must be made. A key variable in this decision is the cost of extending the surveillance 
interval and performing the surveillance off-line. Several of the factors which determine 
the cost of extending the surveillance interval and performing the surveillance off-line are 


discussed below. 
[} Labor 


The amount of work conducted during refueling outages usually requires 
the hiring of outside contract workers. Because they are not full-time employees 
of the plant, these workers constitute an avoidable additional outage cost. Ifa 
surveillance must be done during the outage, extra contract workers may have to 
be hired to perform the work to avoid increasing the length of the outage. This 
will be a factor in the overall cost of extending the surveillance interval and 


performing the surveillance off-line. 


C] Modifications 


Performance interval extension may require upgrading a particular 
component or system to ensure it remains reliable over the entire operating period. 
Redesigning existing components or buying, and installing new equipment is an 
expense which must be included in the overall off-line extended interval 


performance cost. 
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(] Planning 


Outage planning is one of the most specialized areas in the nuclear power 
industry. Outage planners work hard to maximize the number of surveillances 
performed during the core refueling period.. Extending the performance intervals 
of surveillances keeps them in the outage workscope and therefore increases the 
complexity of outage planning. The larger the outage surveillance agenda, the 


larger 1s the outage planning cost. 
[1 Performance Frequency 


The proper choice of performance frequency may save money. Ifa 
surveillance currently performed on a 24 month refueling interval can be extended 
to 48 months, surveillance performance costs will be reduced as a result of the 
surveillance being performed only half the number of times it is performed on a 24 


month refueling interval. 
[1 Power Production 


Surveillances which cannot be completed in an outage before core refueling 
is complete become the critical path towards outage completion... The loss of 
revenue due to lost electricity production would be an added cost of off-line 
extended interval performance. Depending on plant location, lost revenue per 
effective full power day can range from $500,000 to almost $1,000,000 for a plant 
engaged in competition. 

[Licensing 

Changing the performance interval of some surveillances will likely require 
approval from the appropriate regulatory authority. The interval extension 
justification packet will require analysis by a support engineer. The time this 


engineer spends producing the packet will be part of the off-line extended interval 


performance cost. 
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The sum of these six cost factors yields the overall off-line extended interval 
performance cost. This off-line extended interval performance cost for A = True, B = 
True surveillances is an “input” variable because the alternative, performing the 
surveillance on-line, is also an option. The Economic Optimization Engine will ultimately 


determine the performance mode. 


(J (10) Determine the changes in LPEF and CDF from extending the performance 


interval 


Extending the performance intervals of surveillances performed during outages 
may increase the LPEF and/or CDF (as in the case where the operation of an integral 
safety system is checked less frequently). The changes in LPEF and CDF from 
surveillance performance interval extension for A = True, B = True surveillances is an 
“input” variable because the alternative, on-line surveillance performance, is an option. 


The Economic Optimization Engine will ultimately determine the performance mode. 
C1 (11) Determine the time required to perform the surveillance 


During a refueling outage surveillances can be performed in parallel with refueling 
operations without any additional increase in outage length. It is assumed that utilities 
already employ parallel path surveillance planning tools to help minimize outage lengths. 
Once the core is completely refueled, however, surveillance performance generally 
becomes the critical path towards outage completion. Consequently, surveillances 
performed after completing core refueling are extremely expensive. Therefore, the time 
required to perform a surveillance during an outage must be considered by the Economic 
Optimization Engine to determine the combination of surveillance performance modes 
which will minimize the number of surveillances performed after the core has been 
refueled. The time required to perform A = True, B = True surveillances is an “input” 
variable because the alternative, on-line surveillance performance, is also an option. The 


Economic Optimization Engine will ultimately determine the performance mode. 
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2.3.4. Economic Optimization Engine 


The proposed Economic Optimization Engine would be a computer based tool 
which considers all of the “given” and “input” variables of every plant surveillance and 
determines the most economic surveillance performance mode combination while 
maintaining current risk levels. There would be two requirements on the Engine’s 
surveillance performance mode combination conclusions. First, the proposed change in 
surveillance performance modes and performance intervals must be no worse than risk 
neutral for both the LPEF and CDF as compared to original plant cycle length. Second, 


the proposed changes result in the greatest economic benefit. 
There would be three distinct outputs of the Engine: (as represented in Figure 2.6) 
1. The optimal performance mode of all A = True, B = True surveillances 


Since both resolution options are possible, the Engine must determine which 
option, in combination with all other surveillance performance modes, will be the 


most economic route to follow. 


2. The performance frequency of all A = True, B = True surveillances selected for on-line 


performance 


If on-line surveillance performance is selected for surveillances which also have the 
option of interval extension, a surveillance performance frequency must be 
recommended. The frequency may have to be increased in order to balance 
increases in LPEF and/or CDF resulting from the change of the performance mode 


or performance interval of other surveillances. 
3. The performance frequency of all A = True, B = False surveillances 


The frequency may have to be increased in order to balance the increases in LPEF 
and/or CDF resulting from the change of the performance mode or performance 


interval of other surveillances. 
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2.4. Summary 


Figure 2.7 summarizes the entire surveillance resolution methodology. First, a 
determination is made as to whether the surveillance can be performed on-line. Next, a 
determination 1s made as to whether the performance interval of the surveillance can be 
extended to support an extended operating cycle. The surveillances which could employ 
either resolution option are input into the Economic Optimization Engine. (The dotted 
lines represent the “given” variables role in the Engine.) The Engine determines the most 
economical performance mode and performance interval for these surveillances. The 
constraints on this combination of performance modes and intervals ts that the 
recommended plan must be at least risk neutral for both LPEF and CDF as compared to 
the original surveillance plan and the recommended program yields the maximum 


economic benefit. 


The tools necessary to determine changes in CDF as a result of changes in 
performance modes or performance intervals already exist in software packages such as 
RISKMAN developed by EPRI. Similar understanding of the role of LPE’s and the LPEF 
on the overall surveillance structure requires significantly more study. Two other major 
tasks still required to make the Economic Optimization Model/Engine a reality are the 
development of specific quantification methods of the cost factors illustrated in Figure 2.5 
and the computer-based Engine itself. These are both formidable jobs, but ones which 
could play a revolutionary role in reducing the operation and maintenance costs of nuclear 


plants by optimizing the entire plant surveillance program. 
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” Maurer, p. 46. 
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Simplified Surveillance Resolution Flowchart 
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Chapter 3 - Surveillance Categorization 


3.1 Regulatory Based Surveillances 


For the purpose of this study, surveillances performed at the candidate PWR to 
meet technical specification requirements are considered to form the set of regulatory 
based surveillances that must be resolved consistent with a 48 month fuel cycle. The use 
of the technical specifications as the basis for the set of regulatory based surveillances 
provides a simple method for further classifying these surveillances. Surveillances were 
classified and analyzed according to their applicable technical specification section. By 
doing this, the analysis and results presented in this report are compatible with any 
Westinghouse PWR technical specifications including the improved Westinghouse 
Standard Technical Specifications which the Nuclear Regulatory Commission (NRC) 1s 
strongly advocating. Administrative Technical Specifications and Refueling Technical 
Specifications are not included in the analysis because their specific requirements were 
found to be independent of cycle length. Technical Requirements, which are also part of 
the licensing basis, but which only require onsite technical evaluations to change, were 
included as part of this analysis. The PWR technical specification sections which form the 
basis for the analysis are: 

e In-Service Testing/Inspection 

e Section | - Reactivity Control 

e Section 2 - Power Distribution Limits 

e Section 3 - Instrumentation 

e Section 4 - Reactor Coolant System (RCS) 

e Section 5 - Emergency Core Cooling Systems (ECCS) 

e Section 6 - Containment 

e Section 7 - Plant Systems 

e Section 8 - Electrical Systems 


e Technical Requirements 
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Surveillances whose performance satisfied more than one technical specification 
section were only counted one time and placed 1n the most applicable technical 
specification section for analysis. For example, reactor coolant loop flow calibrations 
satisfied technical requirements for both the instrumentation and reactor coolant system 
sections. Because the loop flow calibration requirements closely matched other 
instrument calibrations (temperatures, pressures, levels) found only in the instrumentation 
section, it was placed in the instrumentation section. Where there was no clear 
demarcation line, the surveillance was placed in the first applicable section. For example, 
Engineered Safeguards Pump and Valve Response Time Testing satisfied many technical 
specification requirements including those belonging to in-service testing, plant systems, 
instrumentation, and electrical systems sections. Because it could easily be placed in any 
of the above sections, the first applicable section, in-service testing was chosen. 

There are 1772 individual surveillances performed to meet the requirements in the 
technical requirements and the technical specifications at the candidate PWR plant. These 
1772 individual surveillances, currently matched: to an 18 month fuel cycle, are broken 
down as shown in Table 3.1. 

The 571 surveillances already performed on-line will continue to be performed on- 
line regardless of cycle length and therefore do not affect an extended cycle length. They 
are not be studied further in this report. However, their current performance intervals 
should be evaluated as part of the broader optimization strategy discussed in Chapter 2 to 
determine if their performance intervals are being optimized from both a safety and 
economic standpoint. Analysis of the 1201 remaining surveillances currently performed 
while shutdown forms the basis for the analysis in this chapter. Of these 1201 
surveillances, 278 have performance intervals which are already compatible with a 48 


month fuel cycle, 268 of which are electrical surveillances. 
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18 Month Cycle Regulatory Based Surveillance Breakdown 
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methodology and criteria developed in Chapter 2 of this report, each section analyzes 
those surveillances currently performed shutdown which are applicable to that section, and 
resolves their performance consistent with a 48 month fuel cycle. A detailed discussion of 
the surveillances classified as Category A or B is included. Those surveillances classified 
as Category C surveillances are listed along with a brief discussion. A more detailed 
discussion of all Category C surveillances with possible engineering solutions is provided 
in Chapter 4. A table comparing the current 18 month surveillance performance program 
to the recommended surveillance performance program for a 48 month fuel cycle 


concludes each section. 
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3.1.1 In-Service Testing 


3.1.1.1 Discussion 


In-service testing is performed to meet the requirements of 1OCFR50.55.a(g) 
which requires all nuclear plants to set up and maintain an in-service testing program that 
meets the requirements of the American Society of Mechanical Engineers (ASME) Boiler 
and Pressure Vessel Code, Section XI. The ASME code has the force of law and applies 
to all safety related pumps and valves which are required to perform a specific function in 
the safe shutdown of a reactor, maintaining the shutdown condition, or mitigating the 
consequences of an accident. Testing is performed to assess the operational readiness of 
components, and thus applies mainly to standby components. The ASME code generally 
requires the quarterly testing of pumps and valves, although testing during cold shutdown 
(Mode 5) outages is allowed if it 1s impractical to test quarterly during operation. Cold 
shutdown testing has no specified time interval for performance. Ifa cold shutdown 
condition never occurs during the course of an operating cycle, then cold shutdown testing 
shall be completed during the refueling outage. This means, that for top performing 
plants, the majority of cold shutdown testing is typically performed during refueling 
outages. Each utility must maintain a record showing the rationale for deferring testing to 
cold shutdown intervals. NRC approval is not required to classify a test as a cold 
shutdown test, although the records justifying the extension to cold shutdown are 
auditable. The ASME code also allows tests to be deferred to refueling outages if cold 
shutdown testing or quarterly testing is impractical. The length in months between 
refueling outages 1s defined in the plant technical specifications. These deferrals require 
prior NRC approval and are generally associated with testing involving safety systems that 
cannot practically be tested with the core or vessel head in place. 

As shown in table 3.1 there are 169 surveillances associated with in-service testing 
that are currently performed when shutdown. These surveillances should be resolved to 


Categories A, B, and C as discussed in the following sections. 
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3.1.1.2 Category A Surveillances 


3.1.1.2.1 Valve Operability Checks 


There are seven surveillance valve stroke checks currently performed off-line 
which should be considered for on-line performance. These include stroke checks of 
valves in the Chemical Volume and Control (CS) system, Main Steam (MS) system, 
Service Water (SW) system, and the Power Operated Relief Valve (PORV) block valves. 
Stroke checks are performed to ensure that valves reposition within specified time limits 
based on design basis analysis and to trend their performance from check to check. 
Systems with redundant trains such as SW, or valves whose stroking will not affect system 
~ performance, such as PORV blocking valves, will not impact plant operations or safety 
and thus should be performed on-line. The stroke checks and timing of the Main Steam 
Isolation Valves (MSIV’s) will require the most coordination and advance planning to 
perform. To perform a full stroke check of each MSIV, electrical load provided to the 
grid and reactor power will have to be reduced to less than 75% to ensure that each valve 
can be safely stroked without exceeding core power limits. Although there is little 
incentive to perform MSIV stroke checks on-line on an 18 month cycle, several PWR’s 
with operating cycles of 24 months have chosen to stroke their MSIV’s with the reactor 
on-line, performing the procedure during fall or spring in off peak evening periods when 
power requirements are lowest. Hence, based on industry precedent, on-line stroking of 


the MSIV’s can be safely performed. 


3.1.1.2.2 Remote Valve Position Indication 


There are 18 remote valve position indication surveillances currently performed 
off-line which can be performed with the plant on-line. Remote valve position indication 
checks are performed to ensure that the remote position indications of valves in both the 
open and closed positions match the actual local position of the valves. The position 
indication lights are also often used as a reference when checking the stroke times of 


valves. Typically, remote valve position indication checks are done concurrently with 
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stroke checks of the valve. The remote valve position indication checks which can be 
placed in Category A all involve systems where the valves are currently stroked quarterly 
on-line to meet IST stroke check requirements. All the valves are accessible at power and 
thus the valve position indication can be checked at any time as part of the quarterly 


stroke checks. 


3.1.1.2.3 Relief Valves 


There are 20 relief valve surveillances covering 33 individual relief valves currently 
tested off-line which can be tested with the piant at power. These relief valves are located 
in the diesel, safety injection, core building spray, residual heat removal, demineralized 
water, and waste liquid drain systems. Relief valve testing 1s performed in accordance 
with the “Operations and Maintenance of Nuclear Power Plants, ASME/ANSI (American 
National Standards Institute), OM-1987” Chapter 1. Utilities have the option of testing 
the relief in-place or bench testing a spare relief valve in order to confirm its operability 
and then performing a simple one for one swap of the relief in question. With the 
exception of Main Steam Safety Valves, most utilities opt to perform swaps with bench 
tested spares because it places the individual system out of service for shorter periods of 
time and guarantees that the replacement relief has already passed its lift test. Because a 
system is inoperable while performing relief valve swaps, on-line swaps cannot be 
performed on systems which are required to be active with the reactor on-line such as 
reactor coolant (RC) or component cooling (CC). Passive systems, however, such as 
relief valves for the diesel generators can be replaced by tagging the component out of 
service to ensure inoperability during relief swaps. Relief valve swaps take a minimum 
amount of time and should be able to be performed well within the system LCO time limits 
with proper advance planning. The minimum technical specification LCO time for the 
systems listed above is 72 hours for containment building spray. Even assuming that a 
utility will not voluntarily exceed 50% of a technical specification LCO, that leaves 36 


hours in which to perform a relief valve swap. This policy is reasonable and should be 


pursued. 














3.1.1.2.4 Functional Testing 


There are 41 functional tests currently performed off-line which can be performed 
with the reactor on-line. System functional tests are detailed inspections of each system 
required by the ASME code to check the integrity of welds, piping, and valves System 
engineers at the candidate PWR estimate that 80-90% of each system 1s already checked 
with the reactor on-line and that the remaining 10-20% of the inspections could be 
performed with the reactor on-line with proper planning. For those portions of the 
systems which are inaccessible with the reactor on-line, enough inspection points should 
exist from accessible portions of the system to make a sound technical decision as to 
whether those small portions which are inaccessible could safely be done at 48 month 
intervals. If there are specific concerns about waiting that long between inspections, 


remote cameras or robotic inspection tools could provide the needed information. 


3.1.1.2.5 Pump Operability Checks 


The turbine driven snieeseuey feedwater (EFW) pump operability checks currently 
performed off-line can be performed with the plant on-line. Pump operability checks are 
performed to check that pump parameters including pump head, inlet pressure, differential 
pressure, and vibration are within specification. While the turbine driven EFW pump 
cannot be aligned to the steam generators with the plant on-line because its source of 
suction water is too cold and could cause thermal shock to the steam generators, the 
turbine driven EFW pump can be aligned in the recirculation mode to the Refueling Water 


Storage Tank (RWST) to confirm the necessary pump data. 


3.1.1.3 Category B Surveillances 


3.1.1.3.1 Valve Operability Checks 


There are 17 valve stroke check surveillances which include over 60 individual air 


operated and motor operated valves currently performed while shutdown which could 
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safely be performed at 48 month intervals. These valves are currently stroked at 36 month 
intervals. Based on a station evaluation of motor operated valves in response to Generic. 
Letter 89-10 (Safety-Related Motor-Operated Valve Testing and Surveillance), only seven 
of 122 motor operated valves were recommended for testing intervals (36 months) less 
than 48 months. The remaining valves had recommended maintenance intervals of 72 
months or more and are therefore compatible with an extended fuel cycle. The evaluation 
combined the risk significance of the valve, differential pressure conditions across the 
valve during demand, and whether the valve was required to reposition in case of a design 
basis accident. Based on this review, only those valves which combined a high risk level 
with a high differential pressure across the valve were recommended for maintenance 
intervals less than 48 months®. High differential pressure valves have a significantly higher 
failure rate than valves with low differential pressures. The failure mechanism of concern 
over extended intervals is binding of the valve caused by corrosion/wear product buildup 
or lubrication breakdown. The lubrication can be inspected and replenished at frequent 
intervals. Additionally, most of the valves in this group are large butterfly or gate valves 
which exhibit minimal throttling characteristics over the first half of valve disc travel. This 
valve characteristic allows the partial throttling of these valves without interruption of 
flow to the system. Partial valve strokes at more frequent intervals should eliminate any 
valve binding concerns. Additionally, if the motor is sized correctly for the valve, 
overtorquing of the valve or lack of power from the motor to move the valve to its 
demand position should not be a concern. Utilities which do not partially cycle their 
motor operated and air operated valves to eliminate valve binding should consider adding 


that maintenance practice as part of any long-term surveillance strategy. 


3.1.1.3.2 Check Valves 


There are 28 check valve surveillances which include a total of 106 check valves 


currently performed shutdown which could safely be performed at 48 month intervals. 


* O’Regan, Pat J., Engineering Evaluation 93-44. “Evaluation of the Candidate PWR Response to 


Generic Letter 89-10 (Safety-Related Motor-Operated Valve Testing and Surveillance)”, September 1993, 
p.4. 











Check valve surveillances are intended to confirm check valve operability through either 
visual inspection, radiographic examination, full flow checks through the valve, or checks 
of back seat tightness. Check valves are relatively simple in design, with no power 
requirements and very few moving parts. As long as the pins holding the valve disc in 
place do not bind as the result of corrosion products or other foreign material buildup the 
valve is likely to perform its intended function. A review of plant material history shows 
that the check valves are very reliable. System engineers believe that these 106 check 
valves would easily support a 48 month inspection interval. Similar to the issues 
surrounding motor operated valves, many of these check valves can be partially stroked 
using alternate flow paths. Although this will not provide a full flow check, it will exercise 
the check valve sufficiently to prevent the buildup of corrosion products on the valve 
swing surfaces. In addition to the check valve data available at the candidate PWR, Oak 
Ridge National Laboratories has been maintaining a Nuclear Industry Check Valve (NIC) 


database since 1991 which could also be used to support interval extension justifications. 


3.1.1.3.3 Remote Valve Position Indication 


There are 15 remote valve position indication surveillances, including over 60 
individual valves, that are currently performed with the plant shutdown which can safely 
be performed at 48 month intervals. The ASME code requires that valve position 
indication checks be performed every two years. The valve position indication check 
confirms that the indicated position matches the actual valve position in both the open and 
closed positions. The 15 remote valve position indication surveillances listed in this 
section are typically performed in conjunction with the stroking of the motor and air 
operated valves discussed in section 3.1.1.3.1. Since analysis as shown that these valves 
can be safely stroked every 48 months, the valve position indication checks should also be 
deferred until the valve stroking. Partial verification that the valve position indication 
system is functioning properly can be obtained by checking that the valve position 


indication continues to match the normal position of the valve and that the position 
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changes to mid-position (no open or closed light) during the recommended frequent 


partial valve stroke checks. 


3.1.1.3.4 Leak Checks 


There are four reactor coolant leak rate tests performed as part of the in-service 
testing program which can safely be performed at 48 month intervals. These valves are 
subject to the same 1OCFR50 Appendix J requirements as containment isolation valves. 
After two successive leak tests their performance intervals could be extended to up to 10 


years. 


3.1.1.3.5 Pump Operability Checks 


The three auxiliary feedwater pumps have pump operability checks currently 
performed shutdown which could safely be performed at 48 month intervals. These three 
pumps, the turbine driven EFW, electric driven EFW, and the Startup Feed Pump (SUFP), 
can all be run in the recirculation mode to confirm that most of their key operating 
parameters are within specification. The only requirement that cannot be fulfilled on-line 
is proving that each pump can provide rated capacity to the steam generators. The SUFP 
is only operated to provide water to steam generators in hot standby, wet lay-up, or with 
reactor power less than three percent. All major pump parameters can be confirmed to be 
within specification with the exception of sending water directly to the steam generators. 
The EFW pumps are used as backups to the Main Feed Pumps following a scram in order 
to ensure that the steam generators, which are the primary decay heat removal source, 
continue to receive water. Because the suction water source for the EFW pumps is too 
cold to align to the steam generators with the plant on the line due to thermal shock 
concerns, the EFW pumps should be confirmed operable by combining past performance 
history with pump data available from running the pumps in the recirculation mode or 
against shutoff head with the discharge valves shut. This should provide enough data to 
justify deferring aligning the EFW pumps to the steam generators for capacity checks to 


once every 48 months. 


66 











3.1.1.4 Category C Surveillances 


Chapter 4 provides a more detailed discussion of each of the Category C 


surveillances listed in sections 3.1.1.4.1 through 3.1.1.4.3. 


3.1.1.4.1 Relief Valves 


There are 12 relief valve surveillances, which include a total of 38 individual relief 
valves, currently performed shutdown at intervals less than 48 which cannot be performed 
on line, and are unlikely to be extendible to 48 months. These 38 valves include the three 
pressurizer relief valves which are Class 1 relief valves (primary pressure boundary) and 


35 Class 2 relief valves (containment pressure boundary). 


3.1.1.4.2 Diesel Generator Operability and Engineered Safeguards Pump and Valve 


Response Time Testing 


There are two integrated diesel generator operability and engineered safeguards 
pump and valve response time tests (one for each train) currently performed shutdown at 


18 month intervals which cannot be performed on line, and are unlikely to be extendible to 


48 months. 


3.1.1.4.3 Valve Operability Checks 


There 1s one valve stroke and time check surveillance currently performed with the 
plant shutdown at 18 month intervals which cannot be performed on line, and is unlikely 
to be extendible to 48 months. This surveillance involves the stroke check of three motor 
operated valves evaluated as combining the highest risk level and the highest valve 
differential pressure during operation. These valves are currently recommended for 
performance checks every 36 months and further study is required to justify their 


extension to 48 months. 
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3.1.1.5 Summary of In-Service Testing Surveillances 

Table 3.2 compares the current 18 month surveillance program for in-service 
testing to the recommended surveillance program for a 48 month fuel cycle based on the 
justifications provided above. 


In-Service Testing Surveillance Summary 


Table 3 - 2 









18 MCAtL 


3.1.2 Reactivity Control 


3.1.2.1 Category A Surveillances 


There is one reactivity control surveillance currently performed off-line which 
should be considered for on-line performance. The emergency boration flow test is 
performed to ensure that the two boric acid pumps supply a minimum of 30 gpm to the 
reactor coolant system via the suction of the coolant charging pumps. The test is currently 
performed off-line because planners do not want boric acid injected into the reactor 
coolant system with the reactor on the line. However, this assumes that the boric acid 
pumps must take a suction on the boric acid tanks to achieve their 30 gpm check. 
Inspection of the system reveals that the boric acid pumps can also be aligned to take a 
suction from a 1620 gallon boric acid batch add tank. The batch add tank serves as a 
mixing point for boric acid and uses the same boric acid pumps to fill the boric acid tanks 
to normal levels. For the purposes of this test, the batch add tank could be filled with 
demineralized water and the boric acid pumps aligned to take a suction from the batch add 
tank for the flow check. This has the added advantage of keeping the normal boric acid 
tanks filled during testing in case they are needed for an actual emergency. In the unlikely 


event that they were needed to inject boric acid into the reactor coolant system, it would 
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be a simple matter of repositioning two valves to realign the suction of the boric acid 
pump back to its associated boric acid tank. The redundancy of the system (there are two 
boric acid pumps and boric acid tanks) also means that during the surveillance at least half 


the system would be available to fulfill its normal function. 


3.1.2.2 Category B Surveillances 


Four surveillances currently performed shutdown can safely be performed at 48 
month intervals. One of the surveillances is performed weekly as part of the normal 
refueling outage surveillance package and is independent of cycle length. 

Control and shutdown rod drop testing is currently done at 18 month intervals 
following refueling to guarantee that the control rods have an unimpeded path to the 
bottom of the core and that maximum drop times are consistent with the assumed drop 
times used in the plant safety analysis. While the current plant technical specifications call 
for performance of rod drop testing every 18 months following refueling, the NRC’s 
recent Improved Standard Technical Specifications (ISTS) only require rod drop testing 
following vessel head removal which is a subtle but significant change in wording. Since 
the vessel head will not be removed between refueling periods, rod drop testing can safely 
be performed at 48 month intervals. Core designers should continue to evaluate the 
possibility of fuel swelling over a 48 month cycle to ensure that rod channel clearances 
would not inhibit rod motion and cause rod drop times to exceed design basis limits. 

Rod position indication checks are required every 18 months. The purpose of the 
rod position checks 1s to confirm that the highly accurate (+/- 1 step or +/-5/8 inch) 
demand position for each rod, generated based on the amount of time a rod is withdrawn 
or inserted, matches, within specified limits, the indicated rod position generated by a 
series of coils spaced along each hollow rod tube which produce an inductive analog 
signal. The demand position, although theoretically more accurate, will not identify if a 
rod 1s stuck in the channel during insertion or withdrawal. The purpose of the rod 
position check is to ensure that the two indication systems match over the entire range of 


_ rod motion to ensure that a stuck rod would be identified. Once a plant is at power, the 
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control rods are fully withdrawn and remain fully withdrawn with the long term reactivity 


balance maintained by changing core boron level. As long as the rods are maintained fully 


withdrawn the relationship between the demand position and the indicated position 
remains unchanged regardless of the cycle length. If however. the reactor had to be 
shutdown after more than 18 months since the performance of the last rod position 
checks, then these checks would have to be performed prior to reactor startup. In 
essence, the scheduling of rod position checks could conform to a 48 month cycle. 


However, the rod position checks would be required to be on a hot list for completion. 


3.1.2.3 Category C Surveillances 


There are no category C surveillances for this technical specification. 


3.1.2.4 Summary of Reactivity Control Surveillances 


Table 3.3 compares the current 18 month surveillance program for reactivity 
control surveillances to the recommended surveillance program for a 48 month fuel cycle 


based on the justifications provided above. 


Reactivity Control Surveillance Summary 


Table 3 - 3 
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3.1.3 Power Distribution Limits 






3.1.3.1 Category A Surveillances 


The reactor coolant system flow measurement surveillance currently performed 


during refueling outages can be performed with the reactor on-line. The measurement is 
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performed via a precision heat balance. The procedure for completion of the surveillance 


has no mode requirements for performance. 


3.1.3.2 Category B Surveillances 


There are not category B surveillances for this technical specification. 


3.1.3.3 Category C Surveillances 


There are no category C surveillances for this technical specification. 


3.1.3.4 Summary of Power Distribution Surveillances 

Table 3.4 compares the current 18 month surveillance program for power 
distribution surveillances to the recommended surveillance program for a 48 month fuel 
cycle based on the justifications provided above. 


Power Distribution Surveillance Summary 


Table 3 - 4 
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3.1.4 Instrumentation 


3.1.4.1 Category A Surveillances 


There are 72 instrumentation surveillances currently performed while shutdown 
which should be considered for on-line performance. Thirty-six of these surveillances 


involve instrument calibration checks and 36 involve time response testing. 


TA 








The instrument calibrations include the following instruments: 
Reactor Trip System Instrumentation 
Loop Flow - 12 surveillances 
Pressurizer Level - 3 surveillances 
Power Range Nuclear Instrument (PRNIJ) - 4 surveillances 
Pressurizer Pressure - 4 surveillances 
Temperature detectors - 2 surveillances 
Turbine Impulse Pressure Calibration - 2 surveillances 
Turbine Stop Valve Pressure Switch Calibration - 2 surveillances 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation 
Containment Pressure - 3 surveillances 
Post Accident Monitoring (PAM) Instrumentation 
Excore flux monitors - 2 surveillances 


Reactor Vessel Level Instrumentation - 2 surveillances 


All the instruments listed above are accessible with the reactor on-line. 
Additionally, for Reactor Trip System instruments and ESFAS instruments the ISTS allow 
a channel to be bypassed for up to four hours for surveillance testing. System engineers 
confirm that instrument calibrations can easily be performed in this time frame. One 
channel of PAM instrumentation may be bypassed for up to 30 days, allowing easy on-line 
calibrations. 

In the past, concerns over reactor trips caused by operator error or other spurious 
channel trips during the performance of instrument calibrations led many utilities to defer 
all reactor trip system instrument calibrations to shutdown periods. A relatively 
inexpensive, but key addition, to the Reactor Trip System now allows on-line performance 
of calibrations with significantly less risk of shutdown from either operator error or 
spurious channel trips. The original design of many Westinghouse protective systems 
called for a reactor trip if a trip signal was received from at least two of four instrument 
channels with inputs to the reactor protective system. In the original design, an instrument 


channel was placed in trip to perform on-line tests or calibrations. This meant that a trip 
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signal from only one of the three remaining channels was sufficient to cause a reactor trip. 
This extra trip signal could originate from an actual signal, spurious signal, or by operator 
error if a wrong switch or dial were adjusted during the calibration procedure. This 
system was overly conservative and did not allow for one spurious trip signal as the 
system was originally designed. To correct this problem, the design was changed by 
installation of a Bypass Test Instrument (BTI). With the BT, an instrument is bypassed 
and not placed in trip to perform testing or calibration. While in bypass, the instrument 
provides no inputs to the protective system which is now configured in a two of three 
logic required for a trip. With the BTI installed, safe on-line testing can occur with a very 
high degree of confidence. 

The 36 time response surveillances are performed to ensure that the time interval 
from a given limiting plant condition until the loop produces a corresponding instrument 
signal to the protective system is within specification. These tests are performed at 54 to 
72 month intervals depending on the instrument and can safely be performed on-line 
because of the redundancy and coincidence requirements for each instrument. Their 
current performance interval does not preclude a 48 month fuel cycle, but they should be 


considered for on-line performance. 


3.1.4.2 Category B Surveillances 


There are 42 instrumentation surveillances currently performed shutdown which 
can safely be performed at 48 month intervals. 

Twenty four of the surveillances are inspections of main turbine valves including 
high pressure turbine stop valves, high pressure turbine control valves, and low pressure 
turbine control valves. These valves are currently disassembled, inspected, and 
reassembled at approximately 40 month intervals. Material history records indicate that 
the valves inspections could be performed at 48 months intervals. 

There are 12 calibrations of RCP and 4.16 KV breaker undervoltage and 
underfrequency relays. The calibrations involve the testing of two sets of two relays 


which are responsible for initiating undervoltage or underfrequency trip signals to the 
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Solid State Protection System (SSPS). The signals warn of an impending loss of flow so 
that the SSPS can trip the reactor on an anticipatory loss of flow and prevent a possible 
sequential loss of flow. Both sets of relays must send a signal to the SSPS to initiate a trip 
signal. One of the relays can be bypassed similar to the BTI system described in section 
3.1.4.1 and tested on-line quarterly. The other relay, an Agastat time delay relay, cannot 
be tested on-line because its time delay design cannot be bypassed. Testing therefore 
inserts one of the two trip signals necessary to initiate a reactor trip, leaving the plant in an 
undesirable one of one logic required for a reactor trip. System engineers state, and 
material records confirm, that the failure rates of both these types of relays is so small that 
their tests are extendible to 48 month intervals. As a second option, redesign of the 
Agastat relay device to allow on-line bypass testing would permit these 12 calibration 
surveillances to be performed on-line. 

Reactor Trip System switchgear inspections and post refueling pre startup Reactor 
Trip Breaker surveillances can safely be performed at 48 month intervals. 

Solid State Protective System (SSPS) time response testing is currently performed 
shutdown at 36 month intervals. The highly reliable components of this system can safely 
be tested at 48 month intervals. 

The two Source Range Nuclear Instrument (SRNJ) calibrations can only be 
performed while shutdown. Since they provide an important safety monitoring function 
during reactor startups they should continue to be calibrated at 18 month intervals prior to 
a reactor startup. However, once reactor power is raised into the intermediate range the 
SRNI’s are turned off to prevent detector damage and thus have no function when the 
reactor is at power. SRNI calibrations can therefore be deferred past 18 months as long 
as the reactor stays at power. After 18 months the SRNI’s should be placed on a hot list 
for calibration if the reactor is shutdown before a scheduled refueling outage. Calibration 


should occur before reactor startup is begun. 
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3.1.4.3 Category C Surveillances 


There are two surveillances currently performed while shutdown at 18 month 
intervals which cannot be performed on line, and which are unlikely to be extendible to 48 
months. The two surveillances are identical (one for each train) and verify that the 
automatic safety injection, containment building spray, and containment building air 
systems actuate within allowable time limits upon receipt of a test signal. The tests also 
verify that manual alarms for these systems function correctly. These tests are typically 
performed in conjunction with the Diesel Generator Operability and Engineered 
Safeguards Pump and Valve Response Time Testing described in section 3.1.1.4.2. 


Chapter 4 provides a more detailed discussion of this Category C surveillance. 


3.1.4.4 Summary of Instrumentation Surveillances 


Table 3.5 compares the current 18 month surveillance program for instrumentation 
surveillances to the recommended surveillance program for a 48 month fuel cycle based on 


the justifications provided above. 


Instrumentation Surveillance Summary 


Table 3-5 
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3.1.5 Reactor Coolant System 


3.1.5.1 Category A Surveillances 


There are five surveillances currently performed shutdown which should be 
considered for on-line performance. These include two incore instrument sump level 
calibrations, pressurizer heater kilowatt check, pressurizer pressure control loop 
calibration, and pressurizer relief tank temperature calibration. All the instruments are 
accessible during reactor operation and there are no mode restrictions in the procedures 


for performing the surveillances. 


3.1.5.2 Category B Surveillances 


There are four surveillances currently performed shutdown which can safely be 
performed at 48 month intervals. Two of the surveillances are performed to meet 
requirements when in a refueling outage and are therefore independent of cycle length. 

The reactor coolant pump flywheel bore and keyway are currently ultrasonically 
inspected for volumetric expansion tn the areas of highest stress concentration every 36 
months. Material history records indicate and discussions with system engineers and 
pump vendors confirm that this test could safely be performed at 48 month intervals. A 
complete surface examination of all exposed reactor coolant pump surfaces and a> 
complete ultrasonic volumetric examination 1s conducted at approximately 10 year 


intervals and does not impact on a 48 month operating cycle. 


3.1.5.3. Category C Surveillances 


Steam generator eddy current testing 1s currently performed shutdown at 18-24 
month intervals. This surveillance cannot be performed on line, and is unlikely to be 
extendible to 48 months. Chapter 4 provides a more detailed discussion of this Category 


C surveillance. 
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3.1.5.4 Summary of Reactor Coolant System Surveillances 


Table 3.6 compares the current 18 month surveillance program for reactor coolant 
system surveillances to the recommended surveillance program for a 48 month fuel cycle 


based on the justifications provided above. 


Reactor Coolant System Surveillance Summary 


Table 3 - 6 











3.1.6 Emergency Core Cooling Systems 


3.1.6.1 Category A Surveillances 


There are three surveillances currently performed off-line which should be 
considered for on-line performance. 

The Safety Injection (SI) accumulator outlet valve P-11 surveillance demonstrates 
the ability of the four SI accumulator outlet valves to open automatically when the reactor 
coolant pressure exceeds the P-11 setpoint. The P-11 setpoint 1s a combination of plant 
signals whose simultaneous occurrence is considered to be indication of a large loss of 
coolant accident. The four motor operated valves associated with this test have a low risk 
significance and a low differential pressure across the valve during design operation. 
Based on this, they are recommended for testing at intervals greater than every 10-15 
years. Although valve operation cannot occur with the plant on-line, the P-11 setpoint 
can still be tested by opening the four breakers feeding these motor operated valves and 


installing test gear to show that a valve reposition signal reaches each SI accumulator 


° O’Regan, Table 3. 
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valve upon insertion of a simulated P-11 setpoint. The test could easily be conducted 
within an approved LCO. 

The RHR/RC suction valve interlock verification surveillance is performed to 
ensure that the two RHR pump double suction valves which isolate the high pressure 
reactor coolant system hot leg from the low pressure RHR piping will not open if the 
reactor coolant pressure is 365 psig or greater. The purpose of the interlock is to prevent 
damage to the RHR piping and a possible LOCA. The RHR is a low pressure decay heat 
removal system principally designed for use when shutdown. Removal of one train at a 
time from service for testing with the reactor on-line involves lower risk than if the test 
was performed while shutdown. To ensure that high pressure water is not inadvertently 
injected into the low pressure RHR suction piping should the test fail, the breakers to the 
RHR suction valves motor operators should be opened and test gear installed to confirm 
that the interlock functions properly when attempts are made to open the valve remotely 
with the reactor coolant system pressure greater than 365 psig. 

The containment and containment spray recirculation sump surveillance has no 
mode restrictions associated with its performance and can be performed with the plant on- 
line. The sump is accessible during reactor operations, but additional radiological controls 


might be required to safely perform the surveillance. 


3.1.6.2 Category B Surveillances 


There are five ECCS surveillances currently performed off-line which can be 
performed at 48 month intervals. Four of the five surveillances are performed weekly only 
when shutdown and are independent of cycle length. The ECCS throttle valve verification 
confirms that 12 throttle valves in the SI system have not been moved from their preset 
positions. These valves are inaccessible during reactor operation and thus can only be 
inspected or operated during shutdown periods. The surveillance performance interval is 


therefore independent of cycle length. 




















3.1.6.3 Category C Surveillances 


There are two identical surveillances, one for each ECCS train, currently 
performed off-line at 18 month intervals which cannot be performed on line, and are 
unlikely to be extendible to 48 months. This test which is similar in nature to the ESFAS 
integrated test included in section 3.1.4.3, tests that various ECCS systems will realign 
within specified time limits upon receipt of a SI signal. This includes initiation of 
feedwater isolation, diesel generator start, containment isolation, containment ventilation 
system isolation, and primary component cooling water system (PCC) realignment. 


Chapter 4 provides a more detailed discussion of this Category C surveillance. 


3.1.6.4 Summary of ECCS Surveillances 


Table 3.7 compares the current 18 month surveillance program for emergency core 
cooling system surveillances to the recommended surveillance program for a 48 month 


fuel cycle based on the justifications provided above. 


ECCS Surveillance Summary 


Table 3 - 7 










3.1.7 Containment Systems 


3.1.7.1 Discussion 


The move towards a performance based containment leak testing program, 
approved in the latest changes to 1OCFRSO Appendix J, has made the containment testing 
program compatible with a 48 month fuel cycle. Integrated Leak Rate Tests (Type A) 
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may be performed at up to 10 year intervals based on past performance results. 
Penetration Leak Rate Tests (Type B), and Valve Seat Leakage Tests (Type C) may be 
performed at up to 5 year intervals based on past performance results. 

Leak rate tests are required to be performed with air to simulate the worst case 
design conditions which the valves, piping, or penetrations would be subject to in the 
event of a release of radioactivity to the containment. For this reason, it is very difficult to 
perform leak rate tests of valves in fluid systems with the reactor on-line because the 
system must be drained prior to leak rate testing. Consequently, most of the fluid system 
leak rate tests are performed during outages when the operations department can drain the 


system to support leak rate testing and other required maintenance. 


3.1.7.2 Category A Surveillances 


There are 36 containment surveillances currently performed while shutdown which 
should be considered for on-line performance. All the surveillances involve gas systems, 
systems which can be drained on-line, or personnel hatches which are accessible during 
plant operation. These include Waste Liquid Drains (WLD), Containment Air Handling 
(CAH), Combustible Gas Control (CGC), Fire Protection (FP), Nitrogen Gas (NG), and 
Containment Building Spray (CBS). 


3.1.7.3 Category B Surveillances 


There are 20 containment surveillances currently performed shutdown at 18 month 
intervals whose performance intervals are extendible to 48 months. These 20 surveillances 
include the Reactor Containment Integrated Leak Rate Test and 19 Type C leak rate tests 
performed on systems including: Reactor Coolant (RC), Component Cooling (CC), 
Chemical Volume and Control (CS), Safety Injection (SI), Demineralized Water (DM), 
Reactor Makeup Water (RMW), and Spent Fuel Handling (SF). Some of these fluid 
systems could be drained to conduct air drop tests with the reactor on-line. However, 


because the valve performance history will allow the performance interval to be extended 
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to 48 months, the added work required to perform the testing on-line makes it an 


uneconomical choice. 


3.1.7.4 Category C Surveillances 


There are no Category C containment surveillances. 


3.1.7.5 Summary of Containment Surveillances 


Table 3.8 compares the current 18 month surveillance program for containment 
surveillances to the recommended surveillance program for a 48 month fuel cycle based on 


the justifications provided above. 


Containment Surveillance Summary 


Table 3 - 8 










3.1.8 Plant Systems 


3.1.8.1 Category A Surveillances 


All 10 of the plant system surveillances currently performed off-line should be 
considered for on-line performance. 

Fight of the surveillances involve calibrations of the two emergency feedwater 
flow indication and auto valve closure instruments associated with each of the four steam 
generators. The flow indicators provide a signal which isolates the emergency feedwater 
piping in the event of a feedwater rupture. During instrument calibration this signal is 


unavailable. However, there are two valves and two instruments on each loop and the 
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redundant instrument ts still available to provide an isolation signal if required. Calibration 
of the instruments, one at a time could easily be accomplished during a LCO. 

Both the turbine driven emergency feedwater (EFW) pump and the startup 
feedwater pump (SUFP) can be tested on-line. The surveillance for the turbine driven 
EFW pump involves verifying that steam isolation valves to the pump turbine reposition 
and that the pump starts upon a loss of feedwater flow signal. The test is currently 
performed during cold shutdown because of a desire to avoid putting cold water from the 
turbine EFW pump into the steam generators with the reactor plant hot. However, the 
purpose of this surveillance is only to test whether the pump actually starts and not 
whether water flows to the steam generators. The EFW pump capacity checks to the 
steam generator are performed as part of a separate in-service testing surveillance 
described in section 3.1.1.3.5. Since double valve isolation 1s available between the 
turbine EFW pump and the steam generator, the test can be safely conducted during an 
LCO. 

The SUFP surveillance is a timed test to ensure that operators can manually switch 
the SUFP power supply to an emergency source and manually align the SUFP to the 
steam generators within 30 minutes. The surveillance is performed to show that operators 
can avoid steam generator dryout conditions in the event the motor driven EFW pump is 
lost with the plant shutdown but still hot. The entire surveillance can be safely performed 
on-line during an LCO while maintaining double valve protection between the SUFP and 


the steam generators. 


3.1.8.2 Category B Surveillances 


There are no plant system surveillances which are recommended for off-line 


performance at 48 month intervals. 


3.1.8.3 Category C Surveillances 


There are no Category C plant system surveillances. 
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3.1.8.4 Summary of Plant Systems Surveillances 


Table 3.9 compares the current 18 month surveillance program for plant system 
surveillances to the recommended surveillance program for a 48 month fuel cycle based on 


the justifications provided above. 


Plant Systems Surveillance Summary 


Table 3 - 9 


















3.1.9 Electrical Systems 


3.1.9.1 Discussion 


Electrical system surveillances make up by far the largest portion of individual 
technical specification surveillances (about 48%). The vast majority of these surveillances 
involve breaker inspections, calibrations, or part replacements which are currently 
performed shutdown at 60 month intervals. With the current fuel cycle of 18 months, this 
means that approximately 1/3 of the shutdown surveillances are performed during each 
outage to level the workload. However, if the fuel cycle was extended to 48 months, 
utilities would have to make a choice. They would either have to significantly increase 
their electrical surveillance workscope during outages (a threefold increase) or perform 
more of the surveillances with the reactor on-line. System engineers confirmed that most 
of the 60 month surveillances could be performed on-line, but that planning and execution 
of the surveillances would be more difficult. Utilities will have to weigh the costs of 
performing the majority of electrical surveillances on-line versus either extending outage 
lengths or incurring extra labor costs to complete all the electrical surveillances in the 


current outage time frame. 
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3.1.9.1 Category A Surveiilances 


There are 792 electrical surveillances currently performed while shutdown which 
should be considered for on-line performance. Of these surveillances, 787 deal directly 
with breakers including penetration protection checks, unitized starter checks, molded 
case circuit breaker inspections, thermal overload relay calibrations, and thermal overload 
relay replacements. For each of these 787 surveillances the breaker’s function and its 
electrical accessibility will have to be analyzed to determine if it can be performed on-line. 
Because it was too time consuming and not of significant generic value, each of the 787 
breaker surveillances were not checked to confirm that they could be performed on-line. 
Rather, system engineer interviews were relied upon to confirm that the vast majority of 
these breaker surveillances could be performed on-line. The breaker surveillances which 
cannot be performed on-line have performance intervals of 60 months and are therefore 
already compatible with performance during refueling outages at 48 months. 

Diesel Generator surveillances including periodic inspections, fuel pump flow 
checks, and 24 hour load tests can be performed on-line within a LCO. The technical 
specifications allow up to a seven day LCO with one diesel removed from service. Many 
utilities have gotten NRC permission to extend the length of this LCO to 14 days by 
adding an additional dedicated emergency power source such as a mobile diesel generator 
or a hydro-electric tie line during periods when one of the on-site diesels is removed from 
service for maintenance. A mobile generator would be cost effective if used by a utility 
which owns several plants in close proximity to each other. Use of the mobile generator 
to support site diesel generator maintenance could be coordinated within a utility to 
maximize use of the mobile generator and prevent having to purchase one generator for 
each plant within the utility chain. 

As an important aside, even if on-line performance for diesel inspections is chosen, 
it is my opinion that an 18 month open and inspect interval is excessive and may result in 
more problems than it solves. Diesel generators are prime candidates for performance 
based maintenance programs. This includes the use of advanced on-line monitoring 
techniques such as lube oil, thermographic, and vibration analysis. Additionally, detailed 


trend analyses data are available following quarterly and 18 month full load tests which 
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should be used to confirm proper performance. Serious consideration should be given to 
extending the performance interval of diesel inspections to at least 36 months between 


each open and inspect surveillance. 


3.1.9.2 Category B Surveillances 


There are 22 electrical surveillances currently performed shutdown which can be 
performed at 48 month intervals. Five of these surveillances are performed solely to meet 
outage requirements and are independent of cycle length. Three of the surveillances, two 
Fuel Oil Service Tank cleanings, and a Diesel Generator simultaneous start test, have 10 
year performance intervals and can be scheduled for performance every other outage. 

There are ten breaker overcurrent relay checks including the four RCP breakers 
and the EFW pump breaker which can be performed at 48 month intervals. Material 
history records and system engineer consultation confirm that these relays are highly 
reliable and would allow testing at extended intervals. 

The two emergency power sequencer checks confirm that, in the event of a major 
casualty where electrical power is lost, the diesel generators are sequentially loaded with 
safety components. The safety components are loaded sequentially to ensure that the 
most important components are available first, and to prevent dragging the diesel off line 
from the simultaneous start of all vital safety loads. The sequencing is coordinated 
through the Solid State Protection System (SSPS). With the exception of actually loading 
the diesel, all the logic cards and relays can be checked on a more frequent basis with the 
reactor on-line to confirm that the system remains functional. Diesel generator load 
testing is performed often enough to confirm that the diesel generator can handle the 
required safety load package. 

The offsite power transfer operability check is performed to ensure that the plant 
emergency buses transfer to off-site power in the event of a loss of on-site power. The 
relays and bus transfer equipment are extremely reliable and past performance history 


confirms that the surveillance is extendible to 48 month intervals. 
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The Uninterruptable Power Supply (UPS) undervoltage relay checks are 
comparable to the undervoltage relay checks described in section 3.1.4.2. The Agastat 
time delay relay cannot be checked on-line, but its performance history confirms that the 


testing 1s extendible to once every 48 months. 


3.1.9.3 Category C Surveillances 


There are not Category C electrical surveillances. 


3.1.9.4 Summary of Electrical Surveillances 


Table 3.10 compares the current 18 month surveillance program for electrical 
system surveillances to the recommended surveillance program for a 48 month fuel cycle 


based on the justifications provided above. 


Electrical Systems Surveillance Summary | 


Table 3 - 10 
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3.1.10 Technical Requirements 


3.1.10.1 Discussion 


Technical Requirements are surveillances that were originally part of the technical 
specifications that a utility has removed from the technical specifications and handles 
separately with the permission of the NRC. Although the technical requirements are part 
of the licensing basis for the plant and require a formal Significant Hazards Evaluation 


(1OCFR50.59) to change, changes can be approved on-site and do not require prior 
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approval from the NRC to implement. The technical requirements cover the following 
major areas: 

e Loose Parts Detection 

e Snubber Inspections 

e Fire Pump Operability Checks 

e Hydrant and Fire Hose Inspections 

e Fire Wrap/Fire Seals/Fire Damper Inspections 

e Carbon Monoxide/Smoke Detector Calibrations 

e Fire Protection System Tests 


e Fire Accumulator Inspections 


3.1.10.1 Category A Surveillances 


With few exceptions, all the technical requirement surveillances can be performed 
on-line. The vast majority of fire stations and fire wrap inspection points are accessible 
with the reactor on-line. For the limited number that are inaccessible, past inspection 
history and the availability of most of the inspection points with the reactor on-line 
provide a high degree of confidence that the inaccessible points can be deferred to 
refueling outages at 48 months or made part of a hot list for performance during 
unplanned shutdowns.. 

Snubber inspections and functional testing require the most attention. In the 
candidate PWR there are 286 individual snubbers. There are two main types of snubbers 
in use, mechanical and hydraulic. The mechanical snubbers which were the original 
design, exhibit higher failure rates than the hydraulic snubbers because they are more 
susceptible to system vibration. Testing 1s currently performed with the reactor shutdown. 
Discussions with the snubber system engineer revealed two options that would make the 
snubber testing program compatible with a 48 month fuel cycle. First, since the technical 
specifications, which are the original basis for snubber testing, allow a snubber to be 
inoperable for up to 72 hours, plants could have an inventory of snubber spares that could 


be bench tested satisfactorily and then swapped with in-place snubbers with the plant on- 
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line. The replaced snubber could subsequently be bench tested and after passing its bench 
test, swapped for another in-place snubber and so on. This technique would allow on-line 
testing and still keep the excess inventory of snubbers to a minimum. Second, mechanical 
snubbers which are inaccessible during reactor operation should be replaced with the more 
reliable hydraulic snubbers. The performance history of hydraulic snubbers suggests that 


testing could be extended to 48 months. 


3.1.10.2 Category B Surveillances 


As discussed above, there may be a few inaccessible systems which cannot have a 
surveillance performed with the reactor on-line. In these few cases, material history and 
the surveillance record of the accessible systems will allow interval extension to 48 


months. 


3.1.10.3 Category C Surveillances 


There are no Category C technical requirement surveillances. 


3.1.10.4 Summary of Technical Requirement Surveillances 


Table 3.11 compares the current 18 month surveillance program for plant technical 
requirement surveillances to the recommended surveillance program for a 48 month fuel 


cycle based on the justifications provided above. 


Technical Requirement Surveillance Summary 


Table 3 - 11 
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3.1.11 Summary of Regulatory Based Surveillances 


Table 3.12 provides a complete summary of the PWR regulatory based 
surveillances. The table compares the current 18 month surveillance program to the 


recommended 48 month surveillance program described in this chapter. 


Comparison of 18 Month Regulatory Surveillance Program 
versus Recommended 48 Month Program 


Table 3 - 12 
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The thesis 48 month regulatory surveillance program recommends moving 1013 of 
the 1201 surveillances currently performed off-line to on-line performance modes. This 
would result in 1586 of the 1772 total surveillances (89%) being performed on-line as 
compared to the current 571 of 1772 surveillances (32%). Even discounting the 
additional 792 electrical system surveillances recommended for on-line performance which 


skews the numbers somewhat, the recommended 48 month regulatory surveillance 
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program moves 223 surveillances currently performed off-line to on-line performance 
modes. This increases the percent of non-electrical surveillances performed on-line from 
58% (539 of 926) to 82% (762 of 926). These results are valuable and should be 
considered regardless of whether a 48 month cycle is implemented. The recommended 
program reduces the number of regulatory surveillances required to be performed during 
24 month refueling outages to 83 (166/2) from its current value of 1201, virtually 
guaranteeing that refueling operations will be the critical path to outage completion. The 
fewer number of refueling outage surveillances also means that outside contractor 
assistance to complete refueling outage regulatory surveillances may not be required. This 


would result in a substantial savings. 
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3.2 Investment Protection Surveillances 


Investment protection surveillances include all the non-technical-specification- 
based surveillances performed at the candidate PWR. A small number of these 
surveillances are performed as a result of a commitments to agencies other than the NRC. 
In general, however, the investment protection surveillances discussed in this chapter are 
those whose performance mode and performance interval have been selected at the 
discretion of the utility to protect those systems and components with significant 
investment costs. The performance modes and performance intervals are selected to 
ensure that the reliability of the selected systems and components offsets the cost of 
performing the surveillance. Unlike the technical specification based surveillances 
discussed in section 3.1, utilities have much wider latitude in choosing which surveillances 
to perform and how often to perform them. Additionally, changes to investment 
protection surveillance performance modes or performance intervals can be made directly 
by the utility without a lengthy off site regulatory approval process. Ultimately, decisions 
as to whether to perform and how often to perform investment protection surveillances 
will be driven by how these particular surveillances change the Limiting Plant Event 
Frequency (LPEF) which is discussed in more detail in Chapter 2. 

Investment protection surveillance programs are likely to vary widely from plant to 
plant. Because of this, they do not have a ready classification scheme such as the technical 
specification sections used for the regulatory based surveillance analysis. To provide a 
logical framework to analyze the investment protection surveillances, surveillances were 
grouped by system and placed into three main categories; Nuclear Steam Supply Systems 
(NSSS), Balance of Plant (BOP) systems, and Electrical systems. Several of the systems 
were further grouped into larger categories, such as main turbine systems which includes 
the main turbine generator and all its associated support systems. Figure 3-1 shows the 


overall structure adopted in for the investment protection program analysis. 
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Investment Protection Surveillance Categorization 


Figure 3 - 1 
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Because of the large size of the investment protection surveillance program, only 
those investment protection surveillances currently performed while shutdown were 
evaluated for compatibility with a 48 month fuel cycle. There are over 1300 individual 
investment protection surveillances currently performed while shutdown at the candidate 
PWR. Of these, 457 surveillances have performance intervals which are already greater 
than 48 months and thus are already compatible with a 48 month fuel cycle. Many of 
these 457 surveillances are electrical surveillances similar to those discussed in section 
3.1.9. Most of these surveillances can be performed on-line. They will be discussed 
further in section 3.2.3. 

| During the performance of the investment protection surveillance program 


analysis, many of the NSSS and BOP systems shown in figure 3-1 contained surveillances 
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which were electrically based. This included items such as motor-operated valve 
inspections and cable meggers, unitized starter checks, breaker inspections, and current 
injection testing of breakers. In these cases, these surveillances were not analyzed as part 
of that individual system, but were placed in the “Motor Operated Valve“ and “Other” 
Electrical Systems categories. There were more than 450 surveillance items, with varying 
performance intervals, which fell into these two categories. This classification scheme 
resulted in a system analysis which contained only those surveillances unique to that 
system. This is consistent with the methodology used for the regulatory based 


surveillances discussed in section 3.1 


3.2.1 NSSS Investment Protection Surveillances 
3.2.1.1 Component Cooling (CC) 


3.2.1.1.1 Category A Surveillances 


There are eight CC surveillances currently performed shutdown which should be 
considered for on-line performance. These include calibrations of the four thermal barrier 
flow indicating switches and the two CC supply header temperature sonnel for the CC 
heat exchanger outlet and bypass valves. Additionally, the inspection and lubrication 
surveillance of the actuators for the two CC heat exchanger outlet and bypass valves can 
be performed on-line. The temperature control calibrations and the actuator inspection 
and lubrication of the CC heat exchanger outlet and bypass valves should be performed at 
the same time as they both require that the heat exchanger outlet temperatures be 


controlled in manual during surveillance performance. 


3.2.1.1.2 Category B Surveillances 


There are four CC surveillances currently performed shutdown which cannot be 


performed on-line whose performance intervals are already compatible with a 48 month 
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fuel cycle. The replacement of the transducers and the Bailey positioners for the CC heat 


exchangers temperature control valves are performed every 14 years. 


3.2.1.1.3 Category C Surveillances 


There are nine Class 2 relief valves in the CC system which cannot be tested or 
replaced on-line and whose performance history will not ensure reliable operation for 48 
months between testing or replacement. Relief valves are discussed in more detail in 


Chapter 4. 


3.2.1.1.4 Summary of Component Cooling Surveillances 


Table 3.13 compares the current 18 month surveillance program for Component 
Cooing to the recommended surveillance program for a 48 month fuel cycle based on the 


justifications provided above. 


Component Cooling Surveillance Summary 


Table 3 - 13 
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3.2.1.2 Rod Control (CP) 


3.2.1.2.1 Category A Surveillances 


There are six rod control surveillances currently performed while shutdown which 
should be considered for on-line performance. The four reactor trip breaker inspections 
can be performed on-line. Each breaker has an associated bypass breaker to allow on-line 
testing. The rod drive motor generator set overcurrent protective relay checks are 
allowed to be performed on-line with special permission from the operations manager. 


The special permission required from the operations manager recognizes the potential for 
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an unplanned reactor trip if the surveillance is not carefully planned and executed. Control 
Rod Drive Mechanism (CRDM) command traces can be obtained during the weekly step 


changes performed on each CRDM. 


3.2.1.2.2 Category B Surveillances 


There are 16 rod control surveillances currently performed shutdown which cannot 
be performed on-line but which can be performed at 48 month intervals while shutdown. 

The control rod position indication operational test, rod control operability test, 
and the full speed and direction calibrations are similar to the rod position issues discussed 
in section 3.1.2.2. As long as the plant remains at power, tests of the rod control system 
which confirm its operability over the full range of rod motion are not required. If 
however, the plant shuts down after more than 18 months since the performance of the 
last rod control surveillance, then the surveillances should be performed prior to reactor 
startup. 

There are five clean and inspects that can be deferred to 48 months. Three involve | 
control panel clean and inspects and two involve rod drive motor generators inspections. 
To support the deferment, the inspection procedure should be augmented with some on- 
line inspections. On-line inspections must be limited to visual inspections of the cabinets 
and motor generators for loose connections and dirt. A thermographic inspection of the 
components will provide additional information for determining if they require an actual 
clean and inspect. The component louvers can also be covered with filtering material, 
such as Scott foam, to limit the amount of dust and dirt entering the components. The 
combination of visual inspections and thermographic inspections with the addition of 
filters should allow deferment of the actual clean and inspect to refueling periods. Clean 
and inspects cannot be performed on-line due to the dangers of working around energized 
gear and the possibility of spurious plant trips from dislodging various wires or circuit 
cards during the cleaning process. 

The rod control system power supply has eight surveillances which can be 


performed at 48 month intervals. The CRDM stationary gripper fuses are currently 
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replaced every 36 months. Past performance indicates that the fuses are likely to remain 
reliable to at least 48 months. The rod control system DC power supply load test 1s 
performed every 36 months. Past performance indicates that the power supply is likely to 
remain in specification for at least 48 months. The five breaker inspections involving the 
motor generators and their power supplies are currently performed at 54 month intervals 


and are already compatible with a 48 month fuel cycle. 


3.2.1.2.3 Category C Surveillances 


There are no Category C rod control surveillances. 


3.2.1.2.4 Summary of Rod Control Surveillances 


Table 3.14 compares the current 18 month surveillance program for Rod Control 
to the recommended surveillance program for a 48 month fuel cycle based on the 


justifications provided above. 


Rod Control Surveillance Summary 


Table 3 - 14 










3.2.1.3 Chemical Volume and Control (CS) 


3.2.1.3.1 Category A Surveillances 


There are three CS surveillances currently performed shutdown which should be 
considered for on-line performance. The regenerative heat exchanger return inlet flow 
calibration can be performed on line. A bypass is available which allows the flow meter to 
be removed from service for calibration without interrupting flow to the heat exchanger. 


The flow meter is used to gauge long term flow performance of the system. Short term 
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removal for calibration is acceptable. The two centrifugal charging pump speed increaser 
lube oil pump couplings can be inspected on-line. Only one of two charging pumps is 
required at a time with the reactor at power. One charging pump can be tagged out and 


the surveillance easily conducted within an LCO. 


3.2.1.3.2 Category B Surveillances 


There are three CS surveillances currently performed shutdown which cannot be 
performed on-line but whose performance intervals are already compatible with a 48 
month fuel cycle. Both centrifugal charging pumps mechanical seals are replaced and the 
bearings inspected once every four to six years. Depending on the time required to 
replace the mechanical seals and perform the bearing inspections these two surveillances 
could be considered for on-line performance. The Rotork valve actuator CS-V-189 


inspection is performed every 54 months. 


3.2.1.3.3 Category C Surveillances 


There is one Class 2 relief valve in the CS system which cannot be tested or 
replaced on-line and whose performance history does not ensure reliable operation for 48 


months between testing or replacement. Relief valves are discussed in more detail Chapter 
4. 


3.2.1.3.4 Summary of Chemical Volume and Control Surveillances 


Table 3.15 compares the current 18 month surveillance program for Chemical 
Volume and Control to the recommended surveillance program for a 48 month fuel cycle 


based on the justifications provided above. 
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Chemical Volume and Control Surveillance Summary 


Table 3 - 15 
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3.2.1.4 Nuclear Instrumentation (NI) 


3.2.1.3.1 Category A Surveillances 


There are no Category A NI surveillances. 


3.2.1.3.2 Category B Surveillances 

There are four NI surveillances currently performed shutdown which cannot be 
performed on-line but whose current performance interval 1s compatible with a 48 fuel 
cycle. The gammametrics junction box o-rings are replaced every five years. The J10 
relays for the excore neutron flux monitoring trains are replaced every 48 months. The 
incore detectors interconnecting tube removal and installation is performed as part of the 


refueling sequence and is independent of cycle length. 


3.2.1.3.3 Category C Surveillances 


There are no Category C NI surveillances 


3.2.1.3.4 Summary of Nuclear Instrumentation Surveillances 


Table 3.16 compares the current 18 month surveillance program for Nuclear 
Instrumentation to the recommended surveillance program for a 48 month fuel cycle based 


on the justifications provided above. 
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Nuclear Instrumentation Surveillance Summary 


Table 3 - 16 











3.2.1.5 Reactor Coolant Systems(RC) 


3.2.1.5.1 Category A Surveillances 


There are 37 reactor coolant system surveillances currently performed shutdown 
which should be considered for on-line performance. 

The 14 temperature calibrations on the auctioneered average temperature, loop 
delta temperatures, reactor vessel flange leak off system, pressurizer surge and spray lines, 
and the pressurizer relief discharge lines, can be performed on-line. The instruments are 
accessible at power. They provide indications and in some cases alarms of system 
temperatures, but provide no control functions. The calibrations can safely be performed © 
on-line with other instruments providing enough information during the time the 
instruments are removed from service for calibration. 

There are 12 temperature calibrations performed on the resistance temperature 
detectors (RTD) used to monitor the upper thrust bearing, upper radial bearing, and motor 
stator winding temperatures for each reactor coolant pump. The calibrations can be 
performed remotely from the RTD’s at the reactor coolant pump temperature monitoring 
panel. Since the RTD’s only provide temperature indications they can be safely removed 
from service for short periods of time on-line for calibration. 

There are eight non technical specification relay inspections for each reactor 
coolant pump can be performed on-line. Each reactor coolant pump has an overcurrent 
relay inspection and a ground fault relay. Both relays are accessible and can be removed 


for testing without impacting on the operation of the reactor coolant pumps. 
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Several pressurizer surveillances are allowed to be performed on-line by 
procedure. These include pressurizer heater loops A and B calibrations, and the 


pressurizer level calibrations. 


3.2.1.5.2 Category B Surveillances 


There are 39 reactor coolant system surveillances currently performed shutdown 
which cannot be performed on-line but whose performance interval is either already 
compatible with a 48 month fuel cycle or can be extended to 48 months. 

Each of the four reactor coolant pumps has several surveillances which are 
compatible with a 48 month fuel cycle. Gaskets on each reactor coolant pump are 
replaced once every 12 years. Each reactor coolant pump main flange area is currently 
inspected once every 18 months for boric acid buildup. A review of material history and 
discussions with the reactor coolant pump system engineer suggests that this surveillance 
could be safely extended to 48 months. A routine inspection of each reactor coolant pump 
motor is performed once every 18 months. This routine inspection requires that the pump 
and motor be uncoupled and thus requires the reactor to be shutdown. The inspection is a 
vendor recommended inspection. The reactor coolant pumps also undergo a more 
detailed inspection every four to five years when the motor is removed and sent to the 
vendor for a complete cleaning and overhaul. Material history records and discussions 
with the reactor coolant pump system engineer suggests that the detailed reactor coolant 
pump inspection is sufficient to maintain reliable operation of the reactor coolant pumps. 
Each of the three mechanical seals on the reactor coolant pumps is inspected and replaced 
if necessary every 48 months. 

Several pressurizer related surveillances have current performance intervals of at 
least 48 months. The pressurizer heater control group controller inspection is performed 
every nine to twelve years. The pressurizer heater inspection is performed every 48 
months. The pressurizer vent blank flange is removed and reinstalled to facilitate 
maintenance that is only performed during refueling outages and is thus independent of 


refueling interval. 
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The installation of the reactor coolant system vent and fill evacuation system, 
reactor coolant system draindown system, and steam generator nozzle dams are only 
performed as part of a refueling outage and are independent of cycle length. In 
preparation for reactor coolant system draindown. the reactor coolant system ultrasonic 
level instruments are calibrated. 

The Valcor solenoid valves on the liquid sampling system are replaced every five 
years. 

There is one residual heat removal suction relief valve type C leak test which will 
meet the 1OCFR50 Appendix J leak test requirements and only needs to be performed 


every five years. 


3.2.1.5.3 Category C Surveillances 


There are eight Reactor Coolant System surveillances which cannot be performed 
on-line and whose performance intervals cannot be extended to be compatible with a 48 
month fuel cycle. All eight surveillances involve the four Reactor Coolant Pumps and are 


discussed in more detail in Chapter 4. 


3.2.1.5.4 Summary of Reactor Coolant System Surveillances 


Table 3.17 compares the current 18 month surveillance program for Reactor 
Coolant Systems to the recommended surveillance program for a 48 month fuel cycle 


based on the justifications provided above. 


Reactor Coolant System Surveillance Summary 


Table 3 - 17 























3.2.1.6 Residual Heat Removal (RH)/Safety Injection (SI) 


3.2.1.6.1 Category A Surveillances 


There are no Category A RH/SI surveillances 


3.2.1.6.2 Category B Surveillances 


There are four RH/SI surveillances currently performed shutdown which cannot be 
performed on-line but whose performance intervals are already compatible with a 48 
month fuel cycle. The Namco limit switches for valves RH-V-27,28, and 49 are replaced 
every 10 years (counts as three surveillances). The Valcor solenoid valves for the nitrogen 
vents to Safety Injection Accumulators A, B, C, and D are replaced every five years (all 


four valves are replaced as part of a single surveillance). 


3.2.1.6.3 Category C Surveillances 


There are no Category C RH/SI surveillances. 


3.2.1.6.4 Summary of Residual Heat Removal (RH)/Safety Injection Surveillances 
(SD 
Table 3.18 compares the current 18 month surveillance program for RH/SI 


surveillances to the recommended surveillance program for a 48 month fuel cycle based on 


the justifications provided above. 


RH/SI Surveillance Summary 


Table 3 - 18 
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3.2.1.7 Miscellaneous NSSS Systems Surveillances 


Systems which did not interface directly with the reactor coolant system were 


classified as miscellaneous NSSS systems. These included: 


e Containment Air Purge (CAP) 1 Surveillance 

e Chemical Analysis (CAS) 16 Surveillances 
e Containment Building Spray (CBS) 4 Surveillances 
e Combustible Gas Control (CGC) 2 Surveillances 
e Lead Detection (LD) 9 Surveillances 
e Nitrogen Gas (NG) 2 Surveillances 
e Head Removal (RE) 29 Surveillances 
e Radiation Monitoring (RM) 10 Surveillances 
e Spent Fuel Pool (SF) 6 Surveillances 
e Waste Gas (WG) 3 Surveillances 


3.2.1.7.1 Category A Surveillances 

There are 44 miscellaneous NSSS system surveillances currently performed 
shutdown which should be considered for on-line performance. These include: 

e 16 hydrogen monitor instrument calibrations 

e 9 leak tests on various personnel and equipment hatches 

e 2 nitrogen gas system auxiliary relay magnet block change outs 

e 10 radiation monitor calibrations 

e 4 maintenance items on the spent fuel pools 


e 3 waste gas system calibrations 
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3.2.1.7.2 Category B Surveillances 


There are 40 miscellaneous NSSS surveillances currently performed shutdown 
whose performance intervals already support a 48 month cycle or whose performance 
interval can safely be extended to 48 months. These include: 

e One containment air purge surveillance involving removal of temporary 

spoolpieces 

e Two containment building spray Type C leak rate tests 

e Two containment building spray refueling outage protective cover removals 

e Containment gas control temporary spoolpiece installation and removal 

e 29 Surveillances involving preparations for and vessel head removal for 


refueling 


e Three spent fuel surveillances with performance intervals of 54 months or more 


3.2.1.7.3 Category C Surveillances 


There are no Category C miscellaneous NSSS system surveillances. 


3.2.1.7.4 Summary of Miscellaneous NSSS Systems Surveillances 

Table 3.19 compares the current 18 month surveillance program for the 
miscellaneous NSSS surveillances to the recommended surveillance program for a 48 
month fuel cycle based on the justifications provided above. 


Miscellaneous NSSS Surveillance Summary 


Table 3 - 19 
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3.2.2 Balance of Plant (BOP) Investment Protection Surveillances 


3.2.2.1 Auxiliary Systems 


Auxiliary systems are second tier systems which support the functions of the major 
balance of pliant equipment such as the main feedwater pumps and the main turbine 
generator. The BOP systems classified as auxiliary systems include: 

e Extraction Steam (EX) - 13 surveillances 

e Heater Drains (HD) - 31 surveillances 

e Moisture Separator Drains (MD) - 9 surveillances 

e Miscellaneous Vent and Drains (MVD) - 5 surveillances 

e Steam Generator Blowdown (SB) - 6 surveillances 

e Secondary Component Cooling (SCC) - 2 surveillances 


e Steam Seal Supply (SSS) - 3 surveillances 


3.2.2.1.1 Category A Surveillances 


There are 35 auxiliary system surveillances currently performed shutdown which 
should be considered for on-line performance. 

Extraction Steam - Three extraction steam leak checks can be performed on line. 

Heater Drains - The two heater drain pumps have six surveillances which can be 
performed on-line. The recirculation control calibration checks can be performed on-line 
by placing the heater drain pump recirculation valves in manual control while the 
calibration checks are performed. The heater drain pump upper and lower motor bearings 
oil can be replenished and sampled with the pumps running. Additionally, the two 
overcurrent relay inspections for these two pumps are allowed on-line by procedure. Each 
of the 16 feedwater heaters level control calibrations can be performed on-line. The 
calibrations involve both the level control valves on the outlet of the heaters and 
calibrations on the spill valves for each of the heaters. The calibrations can be performed 
on-line by taking manual control of each of the level control valves during the 


performance of the calibrations. The heater drain tank pressure and level control 
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calibrations can also be performed on-line by controlling both pressure and level manually. 
Finally, the stroke calibration of the tempering valves to the heater drain pump suctions 
can be performed while controlling the tempering valves in manual. 

Moisture Drains - The calibration of the four moisture separator reheater high level 
systems can be performed on-line. Each reheater has three level switches associated with 
it. Two of the three switches must sense high level to actuate an alarm and open a valve 
which will dump water from the reheater. One switch at a time can be removed for 
calibration with the plant on-line during steady state operations. 

Secondary Component Cooling - The SCC supply header temperature calibration 
can be performed on-line by controlling flow manually while the calibration 1s in progress. 

Steam Seal Supply - Calibration of the two turbine generator steam seal pressure 
systems can be performed on-line by manually controlling steam seal supply pressure while 
the calibration is in progress. 

Performance of all the above mentioned calibrations should be performed during 
steady state operations to minimize the necessity for manual adjustments to the systems. 

If load changes are planned, the calibrations should be deferred to limit the risk of 


transients in the associated systems. 


3.2.2.1.2 Category B Surveillances 


There are 36 auxiliary systems currently performed shutdown whose performance 
interval is compatible with a 48 month fuel cycle. 

Extraction Steam - There are 10 surveillances which perform maintenance on 
Gimpel (Miller Fluid) Actuators for valves in the extraction steam system. These 
surveillances have a current performance interval of 54 months and thus are already 
compatible with a 48 month cycle. 

Heater Drains - The alignment of the level control systems for the 16 feedwater 
heaters is currently performed every 36 months. The candidate PWR is considering 
extending this to 48 months as part of their 24 month fuel cycle program. Because the 


calibrations can be performed on-line, it is likely that the alignments only need to be 
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performed every 48 months while shutdown. The heater drain pump rotating assemblies 
are scheduled for replacement every 36 months. Past performance history of the pumps 
indicates that this is probably excessive and would therefore support at least a 48 month 
replacement interval. A performance based system which determines whether the rotating 
assembly should be replaced based on vibration, lube oil analysis, or pump operating 
characteristics should be strongly considered. The heater drain pumps suction strainers 
are cleaned every 18 months. The strainers are cleaned following prolonged system 
shutdowns, such as during a refueling outage, when air is most likely to enter the system 
and cause increased levels of loose general corrosion products in the piping. Once the 
initial system cleanup has been completed, the strainers can be removed for full power 
operations. The system can be flushed using the on site auxiliary boiler as a steam and 
water source just prior to the end of a refueling period, and the strainers then removed for 
extended cycle operations. The heat exchangers for the heater drain systems are inspected 
every 18 months. The performance history for these stainless steel heat exchangers 
suggests that their inspection frequency could safely be extended to 48 months. 

Moisture Drains - The reheater drain tank level control calibration is currently 
performed every 54 months and is therefore already compatible with a 48 month fuel 
cycle. 

Steam Generator Blowdown - There are six valves in the SB system which require 
ASCO solenoid valve replacement every five years. These six surveillances are already 


compatible with a 48 month fuel cycle. 


3.2.2.1.3 Category C Surveillances 


There are seven auxiliary system relief valve surveillances which cannot be 
performed on-line and whose past performance makes it unlikely that the performance 


interval could be extended to 48 months. These are discussed in more detail in Chapter 4. 
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3.2.2.1.4 Summary of Auxiliary System Surveillances 


Table 3.20 compares the current 18 month surveillance program for BOP Auxiliary 
Systems to the recommended surveillance program for a 48 month fuel cycle based on the 


justifications provided above. 


Auxiliary Systems Surveillance Summary 


Table 3 - 20 
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3.2.2.2 Condensate System 





3.2.2.2.1 Category A Surveillances 


There are 14 condensate surveillances currently performed shutdown which should 
be considered for on-line performance. 

The calibrations of the Condensate Storage Tank level control valve, Condensate 
pump recirculation valves, Feed pump seal water discharge pressure valves, Feed pump 
seal water differential pressures valves, and the Main Condenser recirculation valve can all 
be performed on-line by taking manual control of the valves during performance of the 
calibrations. 

The Condensate pump discharge pressure calibrations can be performed on-line. 
Only two of the three condensate pumps are required for full power operations. The 
pumps can be rotated on-line to allow performance of the pressure calibrations. 

The Feed pump suction header pressure switch calibration can be performed on- 
line. The suction header pressure provides an input which will trip the Feed pump. The 
trip occurs on a two of three logic for each Feed pump. Each pressure switch can be 
removed from service individually for calibration. 


The Main Condenser boots on the three sections of the Main Condenser are 


accessible at power and these surveillance inspections can also be performed on-line. 














3.2.2.2.2 Category B Surveiilances 


There are no Category B condensate surveillances. 


3.2.2.2.3, Category C Surveillances 


There are three condensate surveillances currently performed at 18 month intervals 
which cannot be performed with the turbine on-line and whose performance history will 
not allow the surveillance performance interval to be extended to 48 months. All three 
surveillances involve condenser waterbox maintenance. They are possible candidates for 
performance during a reduced power window as discussed in section 3.2.4. They are 


discussed in more detail in Chapter 4. 


3.2.2.2.4 Summary of Condensate System Surveillances 


Table 3.21 compares the current 18 month surveillance program for the 
Condensate System to the recommended surveillance program for a 48 month fuel cycle 
based on the justifications provided above. 


Condensate System Surveillance Summary 


Table 3 - 21 


18 Month 





3.2.2.3. Circulating Water/Service Water Systems 
Although the Circulating Water (CW) and Service Water (SW) provide cooling 
water for different components and systems, they are similar in terms of function and the 


source of water they use as the cooling medium. Thus, they will be considered together 


for this analysis. 
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3.2.2.3.1 Category A Surveillances 


There are 14 CW/SW surveillances currently performed shutdown which should be 
considered for on-line performance. 

There are twelve surveillances which perform checks on the circulating water 
system. The circulating water system consists of three pumps. At full power, all three 
pumps are required. The requirement is based on a maximum allowed temperature rise of 
20° across the condenser based on environmental regulations. Conversations with plant 
engineers indicated that the temperature limit can be observed with only two circulating 
water pumps up to 92% power. Additionally, the candidate PWR is investigating 
upgrading the existing pumps so that the temperature limits can be observed with only two 
pumps. The performance of circulating water surveillance checks which require a pump to 
be removed from service therefore require reduced power operations. Three of the 
surveillances check that the circulating pump lubricating water low flow alarms actuate on 
a loss of lubricating water to the circulating water pump. Water is provided to the stuffing 
box, pump bearing, and motor bearing for each of the three one third capacity circulating 
water pumps. To check each flow switch, the valve providing lubricating water to that 
portion of the pump is closed momentarily to confirm that the low flow alarm actuates. 
The traveling screens on the suction of each pump are removed for inspection every 18 
months and should also be performed while each pump is secured for other testing. The 
final checks that should be performed while the pump is secured is an inspection of the 
lubricating water ports to the stuffing box and pump bearings and an inspection of the 
lubricating water ports to the motor bearing. These checks could be delayed if the flow 
checks on the lubricating water piping and pump and motor bearing temperatures show no 
degrading trend in performance. A review of past performance history shows that the 
traveling screen inspection takes on average about 21 hours to perform. Therefore a three 
day reduced power window is needed to complete all three traveling screen inspection 
surveillances. 

The two service water inspections of the service water traveling screens are 


identical to those for the circulating water system and should be scheduled concurrently. 
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3.2.2.3.2 Category B Surveillances 


There are five CW/SW surveillances currently performed shutdown which cannot 
be performed on line but whose performance interval is already compatible with a 48 
month fuei cycle. The rotating assemblies for the three circulating water pumps and the 
two service water pumps are scheduled for replacement every 54 months. While this is 
already compatible with a 48 month cycle, performance monitoring should be used to 


determine if the rotating assemblies require replacement this frequently. 


3.2.2.3.3, Category C Surveillances 


There are no Category C CW/SW surveillances 


3.2.2.3.4 Summary of Circulating Water/Service Water System Surveillances 


Table 3.22 compares the current 18 month surveillance program for Circulating 
Water/Service Water Systems to the recommended surveillance program for a 48 month 


fuel cycle based on the justifications provided above. 


CW/SW Surveillance Summary 


Table 3 - 22 


18 Months 





“All 14 at reduced power (<92%) 


3.2.2.4 Diesel Generator Systems 


3.2.2.4.1 Category A Surveillances 


There are 26 diesel generator surveillances currently performed shutdown which 


should be considered for on-line performance. Many of these surveillances can be 
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performed in conjunction with technical specification based diesel generator surveiilances 
described in section 3.1.9.2 during a LCO. Allowed outage times of up to 14 days have 
been technically justified and approved by the NRC. Additionally, although many of these 
surveillances have 18 month performance intervals, the performance intervals should be 
considered for extension to at least 36 months as part of an overall diesel generator 
inspection program switch to 36 months being considered within the nuclear industry. 
Diesel generator surveillances which can be performed in conjunction with a one to two 
week allowed technical specification outage on each diesel generator include: 

-Air cooling water temperature control loop calibration 

-Pre-lube oil pump suction strainer element inspection 

-Biannual exhaust valve removal and restoration 

-Air start system air receiver inspection 

-Engine cylinder O-ring replacement 

-Injector cooling water header inspection 

-Air and fluid systems leak testing 

-Air header coupling O-ring replacement 

-Air start distributor maintenance 

-Fuel injection pump stud inspection 

-Diesel generator insulation check 

-Crankshaft thrust bearing inspection 


-Turbo-charger water jacket inspection 


3.2.2.4.2 Category B Surveillances 


There are two diesel generator surveillances currently performed shutdown which 
cannot be performed on-line whose performance interval is already compatible with a 48 
month fuel cycle. The two emergency power sequencer relay inspections require the 
cabinets to be deenergized to perform the cleaning and inspection and should only be 


performed shutdown. 
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3.2.2.4.3 Category C Surveillances 


There are no Category C diesel generator surveillances. 


3.2.2.4.4 Summary of Diesel Generator System Surveillances 


Table 3.23 compares the current 18 month surveillance program for Reactor 
Coolant Systems to the recommended surveillance program for a 48 month fuel cycle 
based on the justifications provided above. 


Diesel Generator Surveillance Summary 


Table 3 - 23 





3.2.2.5 Main Steam System 


3.2.2.5.1 Category A Surveillances 


There are 21 main steam surveillances currently performed shutdown which should 
be considered for on-line performance. The steam dump control calibration can be 
performed on-line. The steam dump valve has manual isolation valves upstream and 
downstream of the valve which will allow it to be isolated and tested on-line. The 
lubrication and inspection of the Terry turbine trip and throttle valve can be performed on 
line by isolating the steam supply to the turbine. The turbine provides a backup feedwater 
source and can be removed from service in an LCO. The thermographic inspection of 
pipe chase insulation is not dependent on plant status and should be performed on-line. 
The two ASDV noise silencer drain line inspections are typically performed off line 
because manual inspections of the piping are dangerous if one of the relief valves should 
lift during the inspection. However, the inspection and cleaning of the piping could easily 
be performed with remote controlled equipment that could perform both the inspection of 


the piping and removal of any debris without subjecting humans to the dangers of possible 
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exposure to high energy steam. Each of the Main Steam Isolation Valves (MSIV) has two 
trains of instrumentation which provide signals to shut the valves. Each train can be 
calibrated individually with the plant at power by taking manual control of the MSIV’s. 
Each MSIV air motor lubrication can also be performed on-line during an LCO with the 
MSIV’s controlled, one at a time, in manual. 

The four MSIV’s have both investment protection and regulatory based 
surveillances associated with them which are currently performed shutdown, but which 
can be performed on-line if plant power is reduced prior to surveillance performance. The 
four investment protection surveillances that must be performed at reduced power during 
a LCO involve periodic maintenance on the hydraulic fluid system which maintains the 
four MSIV’s in the open position. The hydraulic fluid is drained, the fluid reservoir 
cleaned, and the in-line filter replaced at 18 month intervals. This can be done on one 
valve at a time and the plant maintained at <75% power. All the main steam surveillances 
as well as surveillances from other systems that require reduced power for on-line — 
performance should be scheduled concurrently to minimize the length of any reduced 


power window. These surveillances are summarized in section 3.2.4. 


3.2.2.5.2 Category B Surveillances 

There are nine main steam surveillances currently performed shutdown which 
cannot be performed on-line but whose performance intervals would be compatible with a 
48 month fuel cycle. The valve actuators for the four MSIV’s and MS-V-393 have their 
solenoids replaced every four years. The elastometric components for the four MSIV’s 
are currently replaced every three years. A review of their performance history suggests 


that that replacement of the elastometric components can safely be deferred to 48 months. | 


3.2.2.5.3 Category C Surveillances 


There are six main steam relief valve surveillances which cannot be performed on- 


line and whose performance history will not allow the surveillance performance interval to 
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be safely extended to 48 months. Chapter 4 provides a more detailed discussion of relief 


valve surveillances. 


3.2.2.5.4 Summary of Main Steam System Surveillances 


Table 3.24 compares the current 18 month surveillance program for the Main 
Steam System to the recommended surveillance program for a 48 month fuel cycle based 


on the justifications provided above. 


Main Steam Surveillance Summary 


Table 3 - 24 
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3.2.2.6 Feedwater System 


3.2.2.6.1 Category A Surveillances 


There are 45 feedwater surveillances currently performed shutdown which should 
be considered for on-line performance. A large number of the surveillances involve the 
two 50% capacity steam driven main feed pumps. Calibrations of instruments which only 
provide alarms or valve control of valves which can also operated in manual, are readily 
adaptable to on-line performance. These instruments typically have isolation valves which 
allow them to removed on-line for calibration. The parameters measured by these 
instruments can be monitored locally during the performance of the calibrations to ensure 
they are remaining within specification. Instruments which provide signals to trip the feed 
pumps or control the level in the steam generators are more delicate to calibrate on-line 
because improper performance could result in significant plant transients. These 
instruments typically have two or more sensors, with multiple sensor inputs required to 
initiate the trip. Ifa plant analysis shows that there is a significant change in the plant trip 


frequency by performing these types of calibrations on-line, then consideration should be 
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given to performing the calibrations during a reduced power window where steam 
generator level is much easier to control in manual or the loss of one main feed pump 
would not result in a plant transient large enough to cause a plant trip. Individual 
surveillances are described below based on their function in the feedwater system. 

Alarms and Control. The main feed pump recirculation flow indication and control 
is designed to ensure that the main feed pumps maintain a minimum flow of 7,000 gallons 
per minute. The recirculation valves can be controlled in manual locally during testing and 
calibration. The main feed pump pressure and speed indication alarms can be calibrated 
on-line. Pressure and speed indications can be monitored manually during performance of 
the pressure switch calibrations. The main feed pump discharge pressure alarms can be 
calibrated on-line and the discharge pressure monitored during performance of the test to 
ensure it remains within specification. The main feed pump oil pump discharge pressure 
calibrations are currently performed every four years while shutdown. However, these 
calibrations can safely be performed on-line by placing either the alternate or emergency 
oil pumps on the line in manual. 

Trips and Feedwater Regulating Valve (FRV) Control. The main feed pump 
turbine bearing oil and low vacuum trip switch calibrations can be performed on-line. 
Each pump contains two switches which can be bypassed, one at a time, for testing. The 
main feed pump emergency oil pump pressure switch calibration can be performed on-line 
by placing the emergency lube oil pump in run and swapping the pressure switch, which 
turns the pump on upon sensing low lube oil pressure in the pump, with a bench tested 
spare. The main feed pump turbine trip header oil pressure calibration is similar to the 
pump oil pressure calibration and can also be performed on-line. The four surveillances 
which check the position indication and stroke times of the feedwater regulating valves 
requires power to be less than 15% to perform to prevent excessive changes in steam 
generator levels during the valve strokes. These four surveillances should be planned 
during a reduced power window. During performance of the surveillances steam 
generator levels can be controlled using the feedwater regulating valve bypass valves 
which are designed to control steam generator levels with power less than 15%. The 


bypass valves to the feedwater regulating valves can be calibrated and stroked with the 
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plant at power as long as the feedwater regulating valves and the steam generator water 
level control system are maintained in the automatic mode. The main feed pump suction 
header pressure is monitored by three individual pressure switches. Two of the three 
pressure switches are required to cause a main feed pump trip. Each switch can be 
calibrated individually on-line. The main feed pump speed control calibrations can only be 
performed with the main feed pump secured. This surveillance will require a reduced 
power window so that one pump at a time can be secured for speed control calibrations. 
The steam generator steam and feedwater flow instruments provide inputs into the 
steam generator water level control system (SGWLC). Calibration of these instruments 
can be performed by idling one steam generator (securing all feeding and steaming) at a 
time and performing the calibration of the associated steam and feedwater flow 
instruments. In this way, the SGWLC system will not receive inputs from the idled steam 
generator instruments and will be able to properly control level in the three remaining 
steam generators with the plant at approximately 75% power. Past performance records 
indicates that the calibrations on each steam generator feed and steam flow instruments 
takes approximately 24 hours. 
| The four steam generator feedwater isolation valves have two surveillances each 
which can be performed on-line during a reduced power window. The feedwater isolation 
valves are designed to sense rapid drops in steam generator pressure caused by a steam 
line rupture and shut just upstream of the steam generator to stop the steam rupture. Each 
feedwater isolation valve has three Borg Warner pressure switches, two of which are 
required to actuate to trip the valve. The testing of the switches requires that the 
feedwater isolation valves be cycled several times. This can only be performed with the 
steam generator idled and the plant at reduced power below 75%. Prior to completing the 
pressure switch tests, the surveillances which clean and replace the lube oil to the 
feedwater isolation valve actuators should be performed. These surveillances can also be 
performed during a reduced power window with the steam generators idled one at a time. 
The Startup Feed pump is used to control steam generator level with power less 
than three percent. With the plant at power, the pump can be removed from service and 


the surveillances which check the overcurrent relay, ground detection relay, perform trip 
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checks on the output breaker, and change the grease on the pump coupling performed on- 
line. Shaft voltage checks between the main feed pump and main feed pump turbine are 
external measurements and can be performed on-line. The inspection of the brushes on 
the DC motors for the two lube oil pumps associated with each main feed pump can be 


performed one at a time with the main feed pump running and the plant at power. 


3.2.2.6.2 Category B Surveillances 


There are 15 feedwater surveillances currently performed shutdown which cannot 
be performed on-line but whose performance interval are already compatible with a 48 
month fuel cycle. The main feed pump oil tank levels and temperatures are currently 
checked every 72 months and are already compatible with a 48 month cycle. Depending 
on the time required to perform the surveillance, they should be considered for 
performance during a reduced power window when the main feed pump is removed from 
service for the performance of other surveillances. The main feed pump turbine governor 
speed control and valve position calibrations are currently performed every 48 months and 
are already compatible with a 48 month fuel cycle. The four differential pressure 
transmitters for the feedwater regulating valves are replaced every 13 years. The 
diaphragm on the four feedwater regulating valve bypasses are replaced every 54 months. 


The four motor operated valves for the emergency feedwater system are tested every 54 


months. 


3.2.2.6.3 Category C Surveillances 


There are no Category C feedwater system surveillances. Many of the Category A 
surveillances require reduced power operations including idling of individual steam 
generators. Each individual utility will have to make a decision as to whether they feel it is 
cost effective to operate at reduced power during performance of these feedwater system 


surveillances. 
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3.2.2.6.4 Summary of Feedwater System Surveillances 


Table 3.25 compares the current 18 month surveillance program for the Feedwater 
System to the recommended surveillance program for a 48 month fuel cycle based on the 


justifications provided above. 


Feedwater System Surveillance Summary 
Table 3 - 25 








18 Months 


"17 at reduced power levels from <75% to <15% 





3.2.2.7 Main Turbine Systems 


The main turbine system surveillances consist of surveillances for the main turbine 
and generator as well as the key support systems which support turbine generator 
cpseuer The main turbine systems include: 


e Electrohydraulic Control System (EHC) 24 sanvenieace: 


e Generator Stator Cooling (GSC) 11 surveillances 
e Hydraulic Fluid (HF) 3 surveillances 
e Lube Oi! (LO) 9 surveillances 
e Turbine Generator (TG) 6 surveillances 
e Turbine Support (TSI) 5 surveillances 
e Miscellaneous Procedures (MM) _ 16 surveillances 


3.2.2.7.1 Category A Surveillances 


There are 49 main turbine systems surveillances which are currently performed 


shutdown which should be considered for on-line performance. 
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EHC. Twenty two EHC surveillances currently performed shutdown should be 
considered for on-line performance during a reduced power window with the main turbine 
secured. The EHC system flow demand signal indication calibrations and the thrust 
bearing wear detector indication loop calibrations can be performed on-line. Neither 
signal provides an input which could cause a turbine and plant trip. The calibrations of the 
turbine generator first stage pressure, intermediate stage pressure, throttle pressure 
transducers, as well as the calibration of the turbine generator emergency trip system 
pressure switches and master trip pressure switches must be performed with the main 
turbine tripped. Thus, these calibrations must be performed during a reduced power 
window. Past maintenance records indicate that the calibrations require about 24 hours to 
perform. During performance of the transducer and pressure calibrations, several EHC 
electrical surveillances should also be scheduled for performance including cabinet clean 
and inspects, power supply adjustments, voltage comparator checks, and terminal box 
internal wiring checks. While the turbine is secured, the turbine generator speed probe 
gap measurements and speed cable integrity checks which also require the turbine to be 
secured can also be performed. Finally, the eight turbine generator servo valve strainer 
assembly replacements require the turbine to be secured and should be scheduled during 
the reduced power window. Based on historical records, strainer replacements take one 
to two hours to complete. 

GSC. The GSC system which removes heat from the generator stator contains 
two pumps, each of which is capable of providing the necessary flow to remove the heat 
from the helium gas used to cool the generator stator. There are 11 GSC surveillances 
currently performed shutdown which should be considered for on-line performance. Four 
of these surveillances are recommended for performance with the main turbine secured as 
part of the trip avoidance program and thus should be scheduled during a reduced power 
window. These include switch calibrations for the GSC water pressure, inlet flow low, 
and turbine generator bushing coolant flow. The remaining seven surveillances are not 
part of the trip avoidance program and could be scheduled for performance during any on- 
line maintenance period. Plants may want to combine these surveillances with the four trip 


avoidance surveillances and complete all the GSC surveillances during the reduced power 
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window if the additional surveillances are not the critical path to returning to power. 
These surveillances include water inlet pressure control calibrations, GSC cooling pumps 
low pressure switches, stator coolant resin replacement, turbine generator bushing coolant 
flow calibration, GSC water temperature control calibrations, rectifier cooling water inlet 
drain pressure low calibration, and undercurrent relay inspections of the GSC control 
panel. These seven surveillances only provide indications as opposed to the trip signals 
provided by the first four surveillances. 

HF. The hydraulic fluid system provides the high pressure hydraulic fluid to the 
EHC control valves. There are two hydraulic fluid pumps, only one of which ts required 
at any time to maintain system pressure. There are three HF surveillances currently 
performed shutdown which should be considered for on-line performance. The three 
surveillances test the low pressure start features of each pump, the hydraulic fluid low trip 
pressure switch, and hydraulic pump filter differential pressure switch. Each test can be 
performed on a standby pump, with the pump in standby alternated with the on-line pump 
to complete all the surveillance testing. 

LO. There are five lube oil surveillances currently performed shutdown which 
should be considered for on-line performance. The main turbine low shaft pump discharge 
pressure and low bearing oil pressure calibrations require the main turbine to be shutdown 
during their performance and thus should be scheduled during a reduced power window. 
The thrust bearing wear detector trip consists of four pressure switches, with two of the 
four switches required to cause a turbine trip. One switch at a time can be safely removed 
for calibration with the plant on-line. The turbine generator bearing temperature detectors 
can be removed for inspection and bearing temperatures monitored with the use of a 
surface pyrometer during the short inspection interval. The main turbine has three lube oil 
pumps. The primary pump is run directly off the turbine shaft. The two standby electric 
lube oil pumps are for emergency use. Their DC motors can be inspected, one at a time, 
with the turbine on-line. 

TG. There are three TG surveillances currently performed shutdown which should 
be considered for on-line performance. The excitation and shaft grounding inspection, 


installation and removal of the turning gear remote jog switch are both allowed to be 
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performed on-line by procedure and do not increase the likelihood of a main turbine trip. 
The exciter power rectifier Teflon tube inspection can also be performed on-line. The 
tubes are translucent and thus the inspections can be performed without tube removal by 
backlighting each tube with a strong light beam. 

TSI. There are five turbine support instrument surveillances currently performed 
on-line which should be considered for on-line performance. All the surveillances involve 


calibration of the turbine water spray systems. 


3.2.2.7.2 Category B Surveillances 


There are 21 main turbine systems surveillances which cannot be performed on-line 
but whose performance interval can made compatible with a 48 month fuel cycle. 

EHC. Several miscellaneous turbine indicator checks are already performed at 48 
month intervals. The electronic trip solenoid valve (ETSV) filter replacement is currently 
conducted every 54 months. 

LO. There are two LO surveillances which cannot be performed on-line but which 
have performance intervals greater than 48 months and are thus already compatible with a 
48 month cycle. The lube oil temperature indicator calibrations are currently performed 
every nine years. The lube oil control circuit relay and breaker checks are performed once 
every 54 months. 

TG. There are three TG surveillances performed on the generator exciter currently 
performed off-line which cannot be performed on-line but whose performance interval 1s 
already compatible with a 48 month cycle. The exciter inspection and field polarity 
reversal are currently performed every eight years. The exciter field rotor removal and 
installation is currently performed every 54 months. 

MM. There are 16 miscellaneous procedures performed on the main turbine which 
cannot be performed on-line but whose performance tnterval can be made or is already 
compatible with a 48 month cycle. The main generator megger/field resistance check 1s 
currently performed every 18 months. A review of past material records showed that the 


megger and resistance checks were satisfactory during each check over the past six years. 
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Additionally, a ground detection system continually monitors the generator and will give 
indications of possible degradation in generator resistance between inspections. This 
surveillance should be extended to 48 months. There are 13 surveillances which perform 
major inspections of the high pressure and low pressure turbines, generator rotor, and all 
the associated bearings for the turbine and generator. These surveillances are currently 
scheduled once every 72-96 months and are compatible with a 48 month fuel cycle. The 
generator field polarity reversal is also only performed once every 72-96 months. The 
turbine generator lay-up procedure is performed during prolonged shutdowns and is 


independent of cycle length. 


3.2.2.7.3 Category C Surveillances 


There are no Category C Main Turbine Systems surveillances. Many of the 
Category A surveillances require reduced power operations including securing of the main 
turbine with the reactor on-line. Each individual utility will have to make a decision as to 
whether they feel it is cost effective to keep the turbine idle for several days with the 


reactor on-line for surveillance testing. This issue is discussed in more detail in Section 


3.2.4. 


3.2.2.7.4 Summary of Main Turbine Systems Surveillances 


Table 3.26 compares the current 18 month surveillance program for Main Turbine 
Systems to the recommended surveillance program for a 48 month fuel cycle based on the 


justifications provided above. 


Main Turbine Surveillance Summary 


Table 3 - 26 








"28 at reduced power with main turbine secured (<20%) 
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3.2.2.8 Miscellaneous BOP Systems 


There are several investment protection surveillances performed on systems which, 
with few exceptions, have no direct impact on the operation of the balance of plant 
equipment. These include surveillances involving fuel handling equipment, lighting, 


miscellaneous procedures, vibration analysis, and the public address system. 


3.2.2.8.1 Category A Surveillances 


There are 93 miscellaneous BOP system surveillances which should be performed 
on-line. These include all the surveillances dealing with fuel handling equipment (36), 
lighting (3), vibration analysis (22), public address systems (8), and 24 of the 33 


miscellaneous procedures. 


3.2.2.8.2 Category B Surveillances 


There are nine miscellaneous procedures currently performed shutdown which 
cannot be performed on-line but whose performance intervals are already compatible with 
a 48 month fuel cycle. Four of the nine surveillances perform inspections of various plant 
control panels at 48 month intervals. The other five surveillances involve various 
containment hatch removals and installations which are only performed as part of a 


refueling outage and thus are independent of fuel cycle length. 


3.2.2.8.3, Category C Surveillances 


There are no miscellaneous BOP system Category C surveillances. 


 3.2.2.8.4 Summary of Miscellaneous BOP System Surveillances 


Table 3.27 compares the current 18 month surveillance program for the 
miscellaneous BOP systems to the recommended surveillance program for a 48 month fuel 


cycle based on the justifications provided above. 
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Miscellaneous BOP Surveillance Summary 


Table 3 - 27 










3.2.3 Electrical System Investment Protection Surveillances 


Electrical related surveillances make up more than half (690 of 1336) of the total 


investment protection surveillances performed at the candidate PWR. As with the 


regulatory based electrical surveillances, the vast majority of these surveillances can be 


performed on-line. Additionally, most of these surveillances also have current 


performance intervals which are already compatible with a 48 month fuel cycle. Because 


it was too time consuming and not of significant generic value, each of the electrical 


surveillances was not checked to determine its optimum performance category. Each 


individual utility will have to determine the proper mix of on-line and off-line performance 


for their plant which can be both safely and economically performed. The electrical 


system surveillances were broken into five principal categories. These areas are: 


Motor Operated Valves 


Electrical Distribution 


Emergency Electrical Distribution 


Switchyard 
Other 


119 surveillances 
109 surveillances 
67 surveillances 
64 surveillances 


331 surveillances 


Switchboard clean and inspects are a major class of electrical surveillances which 


will likely have to be performed more often than once every 48 months. Because of the 


high voltages in many of the switchboards, it is essential to that they be kept clean to 


minimize the risk of arching damage and potential electrical fires. Cleanliness levels can be 


improved by installation of simple filter pads on the louver areas of the switchboards. 


Thermographic inspections may also be used to help determine any impending hot spots in 


the switchboards which may require further investigation. 
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3.2.4 Surveillances Requiring Reduced Power Windows 


There are a large number of investment protection surveillances which can only be 
performed on-line if the plant is operated at reduced powers. Most of these surveillances 
also have performance intervals well short of 48 months and thus a decision must be made 
as to whether to shutdown or perform the surveillances at reduced power with the reactor 
on-line. Because utilities have much wider latitude in choosing the performance interval 
and performance mode of these surveillances, each individual utility will have to determine 
the safest and most economic way to perform each of these surveillances. 

Performance of the surveillances in a reduced power window offers several major 
advantages when compared to shutting down to perform the surveillances. First, the time 
to recover the plant to full power following surveillance performance is significantly 
reduced. In the case of surveillances which do not require the main turbine to be secured, 
return to full power can be accomplished in a matter of hours. Secondly, by maintaining 
the reactor plant and the steam plant hot, fewer thermal cycles over the life of the plant 
will be required. On-line performance also does not require the major changes in both 
reactor and steam generator chemistry that is required following shutdown. Finally, 
historically, plant equipment problems often occur on equipment that has been returned to 
service following shutdown, even though that same equipment had been running reliably 
prior to the shutdown. 

On-line performance of the many of these surveillances does have some 
disadvantages. Because the plant is still at power, the possibility of a plant trip or 
transient is possible even though the reduced power condition should eliminate most of 
these concerns. Most importantly, for those surveillances which require the main turbine 
to be secured, the reactor is producing power and burning fuel but is not producing 
revenue generating electricity. Thus the economic penalty from burning the fuel may be 
greater than the extra time required to bring the plant back to full power from a shutdown 
condition. If this is the case, the utility should opt to shut the plant down for surveillances 
requiring the main turbine to be shut down. 

Table 3.28 provides a summary of the surveillances recommended for performance 


during a reduced power window. The table also lists the recommended power level for 


126 














surveillance performance, the average time to perform the surveillance based on historical 
records at the candidate PWR, and whether the main turbine must be secured during 


surveillance performance. 


Summary of Surveillances Recommended for 
Performance during Reduced Power Windows 


Table 3 - 28 
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3.2.5 Reduced Power Surveillance Window Economic Analysis 


Based on the surveillances listed in Table 3.28 a simplified economic analysis and 


possible bounding sequence for performance of surveillances in reduced power windows 
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was developed. The bounding sequence shown in Figure 3-2, is one of several scheduling 
options that could be used to complete the recommended reduced power windows 
surveillances. For instance, utilities may choose to perform the reduced power sequences 
over the course of several weekends when their power demands are the lower rather than 
performing all the reduced power surveillances during one consecutive 10-11 day period 
as shown in Figure 3-2. Ifa utility chooses to perform the surveillances in short blocks, 
rather than in one longer period, all the surveillances which can be done in parallel at that 
given power should still be scheduled for completion to minimize the time required to be 
in a reduced power window. Additionally, since all the surveillances recommended for 
reduced power windows have performance frequencies of 24 months or more, they should 
all be scheduled for completion during the middle of the fuel cycle so that the reduced 


power surveillance option must only be exercised once during the entire 48 months cycle. 
The economic analysis was performed as follows: 


Assume: (1) Replacement Power Costs of $600K per day 


(2) Ramp up and down times one day longer for shutdown strategy 


Based on Figure 3-2, the number of days at each power during the 10 day reduced power 
window 1s: 

92% - 3 days 

75% - 4 days 

50% - 1 day 

0% - 2 days 
Note: There is a small fuel penalty if the reactor is kept on-line during turbine 
maintenance. This penalty is estimated to be less than 5% of the total lost revenue from 


surveillance performance during a reduced power window. 
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Lost Revenue (in Millions) During 10 Day Reduced Power Window: 


$0.6/day * 3 days * 0.08 = $0.14 

$0.6/day * 4 days * 0.25 = $0.6 

$0.6/day * 1 day * 0.50 = $0.3 

$0.6/day * 2 days * 1.0 = $)h2 

Lost Revenue $2.24 Million (Over 10 day reduced power window) 


Days Shutdown for the Equivalent Cost of Performing Maintenance in Reduced Power 


Windows 
2.24 Million/0.6 Million/Day = 3.7 days 


Less extra up and down time _1 day 


Max Time Allowed 2.7 days shutdown 


There are several pros and cons to performing surveillances in a reduced power window 

as opposed to a shutting down to perform the surveillances. 

Pros 

¢ Reduces thermal stresses and cycles on the plant 

e Fewer primary and secondary chemistry changes 

e Minimizes the amount of reliably running equipment that must be secured 

e Reduced penalty, in general, for unexpectedly long surveillance completion times at 
power as compared to shutdown | 
Allows immediate retests of equipment after surveillance performance 

Cons 
Makes maintenance generally more difficult to perform because of heat/noise/radiation 
levels while at power 

e Has unrecoverable costs from burning fuel burned while performing maintenance at 
self-sustaining conditions 


e Results in abnormal plant lineups for several days which, although allowed, are not as 


familiar to the operators. 
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Example Reduced Power Window Surveillance Sequence 


Figure 3 - 2 


‘Steam and Feedwater Flow Calibrations 















:;CW/SW Pump Maintenance 


‘Traveling Screen Inspections 


Surveillance 


: 92% Power 
: 1 CW/SW Pump tested 


: at a time 


Reactor 


Power 


FWIV Strokes and Fluid Change 


MSIV Stroke Checks/MSIV Maintenance 


FCV Indication and Stroke Checks 


MFP Gov Checks 


73% Power 50% Power , 
1 S/G Idled at '1 MFP tested at: 
a time a time : 


EL gta vata © Sle! ORM ene et ey cee a ees Boke ea a Re ee a RR BSE gee ed sen SE SSN, Gai aN BR NES 


Reduced Power Window Days 


130 





Condenser Waterbox 


10% Power 
Main Turbine 


Secured 











Conclusions 


The shutdown strategy from a pure cost standpoint is effective only if the maintenance 
window can be completed in Jess than 2.7 days which may be difficult. Utilities must also take 
into account the pros and cons listed above when considering an overall strategy. Utilities must 
also recognize that there is likely to be an increased risk of a plant trip from on-line performance 
of these surveillances at reduced powers. A more detailed economic analysis which accounts for 
fuel costs in more detail, changes in plant trip frequency or limiting plant event frequency (LPEF), 
and the time savings from on-line performance of the surveillances performed must be conducted 
before a final decision on which, if any, of these surveillances should be performed in a reduced 
power window. Any of these surveillances which is not performed on-line must be placed in 


Category C and will require further study to remove the surveillance as a barrier to a 48 month 


fuel cycle. 
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3.2.6 Summary of Investment Protection Surveillances 


Table 3.29 summarizes the recommended investment protection surveillance program at 


the candidate PWR, less the electrical surveillances. 


Summary of Recommended Investment 
Protection Surveillance Program 


Table 3 - 29 
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"67 at reduced power 





The 690 electrical surveillances were not included in table 3-29, because as previously 
explained, the precise performance mode for each individual surveillance was not determined. 
Most of these 690 surveillances could be performed on-line and thus are likely to fall into 


Category A. 
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3.3 Summary of Recommended PWR Surveillance Program 


This chapter includes the analysis of the entire surveillance program at an operating PWR. 
By doing this, the chapter has met two of the primary goals of this project. First, it has 
demonstrated that the regulatory and investment protection barriers to extended cycle lengths can 
be overcome. With the few exceptions discuss in detail in Chapter 4, the vast majority of the 
PWR surveillances are resolvable to a 48 month fuel cycle. Table 3-30 summarizes the entire 
PWR surveillance program, including the investment protection 690 electrical surveillances which 
were considered likely Category A surveillances. Of the 3108 surveillances considered at the 
candidate PWR, only 54 were considered potential barriers to an extended cycle. Sixty-seven of 
the 2673 Category A surveillances are candidates for on-line performance during a reduced power 
window. Second, this chapter in conjunction with the methodology presented in Chapter 2 has 
demonstrated a systematic surveillance resolution procedure that utilities can use to prepare for 
extended cycle lengths. As was previously stated, the recommendations provided in this chapter 
are valuable regardless of when an extended cycle is adopted. Implementation of the 
recommendations provided in this chapter will significantly reduce the number of surveillances 
required to be performed during 18-24 month refueling outages. This will result in cost savings 
from reduced outside contractor manpower requirements as well as the likelihood that the 


refueling sequence is now likely to be the critical path to power restoration. 


Summary of Recommended 
PWR Surveillance Program 


Table 3 - 30 










Protection 
| Totals | 3108 | 2673' | 381 | 54 | 


"67 at reduced power 
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Chapter 4 - Category C Surveillances 


4.1 Introduction 


All the Category C surveillances identified in Chapter 3 are collected and analyzed in more 
detail in this chapter. These are the set of surveillances which are currently identified as barriers 
to attaining a 48 month fuel cycle. Where available, possible engineering solutions to the 
Category C surveillances are proposed. Detailed engineering solutions to the complete set of 
Category C surveillances identified in this thesis will form the basis for significant future work for 
the MIT Extended Fuel Cycle Project team. 

Hideki Masui in his thesis entitled “Quantitative Methodology for Surveillance Interval 
Extension at Nuclear Power Plants”, May 1996, provided a methodology to quantitatively 
rationalize the proper surveillance interval. In it, he established the economic and safety 
requirements which are consistent with a longer operational cycle. The strategy and data 
requirements for the analysis are described in detail. This type of methodology provides a method 


for reexamining the Category C surveillances discussed in this chapter. 


4.2 Regulatory Based Category C Surveillances 


4.2.1 Relief Valves 


At the candidate PWR plant there are 12 relief valve surveillances involving 38 individual 
relief valves which are currently performed shutdown at intervals less than 48 months. These 
relief valves cannot be tested on-line, and because of their performance history, testing is unlikely 
to be extendible to 48 months. These 38 valves include the three pressurizer relief valves which 
are Class 1 (primary pressure boundary) relief valves and 35 Class 2 (containment pressure 
boundary) relief valves. 

The Operations and Maintenance of Nuclear Power Plants, ASME/ANSI (American 
National Standards Institute), OM-1987, Chapter 1, lists the requirements for in-service 


performance testing of nuclear power plant pressure relief devices. It requires that all Class 1 
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relief valves be tested every five years and that at least 25% of each type of Class | valve be 
tested every 24 months, 50% every 36 months, 75% every 48 months, and every relief be tested 
at least once every 60 months. Relief types are classified by their discharge diameter size in inches 
and how their design (i.e. spring actuated, pilot actuated). Plants have the option of testing their 
relief valves in place or replacing the relief valves with bench tested spares. With the exception of 
Main Steam Safety Valves, which because of their sheer size are usually tested in-place, most 
utilities opt to use the bench testing method to satisfy the code requirements. Class | relief valves 
which are replaced with bench tested spares are also required by the code to undergo bench 
testing after removal to determine if the valves exceeded the stamped set pressure criteria of 3% 
or greater at the time of replacement. For those Class | relief valves failing to meet the set 
pressure acceptance criteria, the causal effect must be evaluated to determine the need for 
additional tests'°. Although the code, as currently written, precludes extending the test interval 
on Class 1 relief valves to 48 months, data at the candidate PWR received from the company 
which bench tests their replaced Class 1 relief valves shows that the pressurizer relief valves are 
always within specification when removed at 18 month intervals. This indicates that the 
requirement to test at least 25% of these relief valves every 24 months may be overly conservative 
and should be investigated. However, because of their safety importance, a more detailed 
technical analysis is needed to justify extending the performance interval on Class | relief valves 
to 48 months. The NRC Generic Safety Issues Branch (GSIB) in the Office of Nuclear 
Regulatory Research is currently reviewing failure modes and failure rates of relief valves and 
evaluating the advantages and disadvantages of possible changes to the ASME code testing 
requirements. ” 

As with Class 1 relief valves, utilities have the option of testing Class 2 relief valves in 
place or replacing the relief valves with bench tested spares. However, Class 2 relief valves are 
only required to be tested every 10 years with at least 25% of each type tested every 48 months. 
This would appear to make Class 2 relief valves already compatible with the 48 month extended 


fuel cycle. However, most plants are currently testing these relief valves on a more frequent basis 


'° Operations and Maintenance of Nuclear Power Plant, ASME/ANSI, 1987, Chapter 1. p. 5. 
"| Cherny, Frank, USNRC Office of Research, Generic Safety Issues Branch, letter of 2 February 1996. 
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(18 to 24 months), and unlike the pressurizer relief valves discussed in the preceding paragraph, 
the performance of Class 2 relief valves has not proven historically to be good enough to allow 
testing at intervals of 48 months. During the most recent outage at the candidate PWR seven of 
the 31 Class 2 relief valves tested failed their lift test check after only 18 months of operation. 
This type of failure data precludes 48 month testing intervals of the 35 Class 2 relief valves which 
are in active systems and cannot be tested with the reactor on-line. Further analysis of industry 
wide relief valve failures, including the valve type, valve size, system fluid conditions, and 
environmental conditions at the relief location must be performed to determine the principal 
failure mechanisms and allow recommendations for improvement. Relief valves have universal 
applications and are used in many industries besides the nuclear industry so a large amount of data 
should be available for a detailed analysis. Additionally, if possible, trending of valve degradation 
with time should be considered. Valves with linearly increasing set pressure variations must 
eventually be corrected and will have problems with extended fuel cycles. Conversely, relief 
valves which exhibit a short term, large jump in pressure variation followed by stable operation 
may be satisfactory for long term operation. Ifthe trend of valve degradation is not well 
understood, the wrong conclusions may be drawn regarding a valve’s long term behavior and 


compatibility with an extended fuel cycle. 


4.2.2, Motor Operated Valves 


The candidate PWR has surveillances involving MOV’s which cannot be performed on- 
line and are unlikely to be extendible to 48 months. MOV’s have received widespread attention in 
the nuclear industry since the issuance of Generic Letter 89-10 (Safety Related Motor Operated 
Valve Testing and Surveillance). GL 89-10 requested that all MOV’s in safety related systems 
have their design basis reverified, that the valves be set-up and diagnostically tested, and where 
practical tested to their design basis condition. A detailed review of all the MOV’s at the 


candidate PWR as part of GL 89-10 requirements identified three basic categories of MOV’s*: 


'2 O’Regan, p. 3. 
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1) MOV’s that are position-changeable-only valves. Position changeable valves are 


valves which are normally in their safety related position and thus only require the motor 





to realign the valve to it’s normal position following testing 


2) MOV’s with high safety significance and high differential pressures across the valve 


when required to actuate, and 


3) MOV’s with high safety significance and low differential pressures across the valve 


when required to actuate. 


Using the above classifications, the valve failure rate (directly related to differential 
pressure) is combined with its risk significance to determine the acceptable testing interval for 
each valve. Because the failure rate for high differential pressure valves is significantly higher 


than the failure rate for low differential pressure valves, the failure rate, independent of the risk 





significance, is the dominant factor in determining the acceptable testing intervals. 


Of the 122 MOV’s at the candidate PWR, only six of the valves have high differential 
pressure operating conditions and high risk significance. These six valves have recommended 
performance intervals of 36 months. Of these six MOV’s, only three cannot be tested with the 
reactor plant on-line. These three MOV’s are covered by a single surveillance and are all valves 
in the Safety Injection System.. The remaining 116 MOV’s either have testing intervals 
compatible with a 48 month cycle or have been recommended for removal from the surveillance 
program because they are changeable position valves which are already in their required safety 


position. 


4.2.3 In-Service Testing 


The ASME Boiler and Pressure Vessel Code, Section XI, “Rules for In-Service Inspection 





of Nuclear Power Plant Components”, requires that all safety related pumps and valves be tested 
for operability on a quarterly basis. In some cases it is hazardous or simply impossible to perform 


the tests while the plant is at power. In general, surveillances which are hazardous to perform on- 
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line involve stand-by systems such as the Residual Heat Removal System or Safety Injection. 
Rather than shut down every three months to perform these operabilitv tests, utilities may petition 
the NRC to designate a surveillance that cannot practically be performed with the reactor core 
installed as a refueling test and defer the surveillance to refueling periods. These requests can be 
augmented in the future by risk-based arguments Utilities may also opt to designate tests that are 
not as limiting as refueling tests but which still cannot be performed with the plant on-line as cold 
shutdown tests. Cold shutdown test justifications must be documented and can be audited by the 
NRC, but do not require prior approval of the NRC to designate them as a cold shutdown test. 
Once a surveillance is designated as either a Refueling or Cold Shutdown Test, it does not have to 
be performed every three months if the plant is operating continuously over that period of time. If 
however, a plant incurs an unplanned outage after more than three months from the last in-service 
testing period, the ASME code requires the following rules be followed for all surveillances 


designated as Cold Shutdown Tests: 


e Testing is to commence as soon as practical when the Cold Shutdown condition is 
achieved, but no later than 48 hours after shutdown, and continue until all testing is 


complete or the plant is ready to return to power. 


e Completion of all testing is not a prerequisite to return to power. Any testing not 
completed during one cold shutdown should be performed during any subsequent cold 


shutdown starting with those tests not previously completed done first. 
e Testing need not be performed more often than once every 3 months. 


e Inthe case of an extended cold shutdown, the testing need not be started within the 48- 
hour limitation. However, in extended cold shutdowns, all Cold Shutdown Testing must 


be completed prior to returning to power. 


If a plant operates uninterrupted for an entire cycle, cold shutdown testing is only 


performed during refueling outages. Since the longest operating cycles in the United States are 
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approximately 24 months, the maximum current interval on a Cold Shutdown Test is 24 months. 
The question that then arises is is there an upper limit on the allowable length between cold 
shutdown testing? The ASME code does not address the question of how long is long enough, 
and opinions vary as to the likelihood of 48 month surveillance intervals being acceptable. 
Conversations with regulatory personnel and system engineers at the candidate PWR indicated 
that there is sufficient performance data available to make the case for interval extension on most 


of the components covered by the code. 


If the interval extension cannot be technically justified, most of the designated cold 
shutdown surveillances are relatively simple to perform and are excellent candidates for a 
surveillance performance hotlist. This hotlist would track those surveillances which should be 


prepped and ready to be performed immediately whenever the plant 1s shutdown for any reason. 


To further solve the in-service testing interval question new technologies should be 
investigated to provide a means of justifying surveillance performance intervals out to 48 months. 
Application of innovative monitoring technologies could provide enough on-line diagnostic 
information on the various pumps and valves to ensure operability upon demand. This would 
ultimately remedy the burden of maintaining some or all of the Cold Shutdown Operability Tests 


on the surveillance performance hotlist. 


4.2.4 Engineered Safety Features 


There are six separate surveillances involving three similar Engineered Safety Feature 
Actuation System (ESFAS) tests (two trains each) performed at the candidate PWR which cannot 
be performed on-line, and which are not likely to be extendible to 48 months. These are 
integrated tests which involve sensors, signal processing, and valve and pump actuation. They 
cannot be performed on-line because of the risk of injecting cold water into an operating reactor 
which will result in a large and potentially dangerous power excursion. Each test 1s described in 


more detail below. 
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4.2.4.1 Diesel Generator Operability and Engineered Safeguards Pump and Valve 


Response Time Testing 


There are two integrated diesel generator operability and engineered safeguards pump and 
valve response time tests (one for each train) currently performed with the plant shutdown at 18 
month intervals which cannot be performed on line, and which are unlikely to be extendible to 48 
months. It may be possible to devise a safe test which would test the integrated features of all the 
safety systems involved with the exception of actually putting water into the core with the reactor 
critical. However, because this test is central to proving that cooling water can be delivered in 
sufficient quantities to prevent damage to the core and the containment in the event of a major 
Loss of Coolant Accident (LOCA), non-technical factors must also be considered when 
contemplating extending to 48 months those portions of this test that provide system proof of 


flow to the reactor vessel and containment. This surveillance should be studied further. 


4.2.4.2 Actuation of Auto Safety Injection, Containment Building Spray, and Control 
Building Air systems | 


There are two surveillances in this category currently performed while shutdown at 18 
month intervals which cannot be performed on line, and which are unlikely because of safety 
concerns to be extendible to 48 months. The two surveillances are identical (one for each train) 
and verify that the automatic safety injection, containment building spray, and control building air 
systems actuate within allowable time limits upon receipt of a test signal. The tests also verify 
that the manual alarms for these systems function correctly. These tests are typically performed in 
conjunction with the Diesel Generator Operability and Engineered Safeguards Pump and Valve 
Response Time Testing detailed in section 4.2.4.1. While it may be possible to design an 
integrated test which measures the response time of the instrumentation without any valve 
actuation, the test setup is likely to be very complex and place the plant in a very unstable 
condition during the testing because of the removal of one complete ESF train for an extended 


period of time. Further study of these integrated ESF tests is needed. 
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4.2.4.3 Emergency Core Cooling Systems Automatic Actuation Test 


There are two identical surveillances, one for each ECCS train, currently performed off- 
line which cannot be performed on line, and which are unlikely to be extendible to 48 months. 
These tests are typically performed in conjunction with the other ESFAS integrated test included 
in sections 4.2.4.1 and 4.2.4.2. This surveillance tests that various ECCS systems will realign 
within specified time limits upon receipt of a SI signal including the initiation of feedwater 
isolation, diesel generator start, containment isolation, containment ventilation system isolation, 
and primary component cooling water system (PCC) realignment. While all but two of the motor 
operated valves in the test are recommended for testing at intervals greater than 48 months, and 
other individual parts of the test can probably be conducted on-line, a method to test the 


integrated nature of the system on-line requires further investigation. 


4.2.5 Steam Generator Eddy Current Testing 


Steam generator eddy current testing is currently performed shutdown at 18-24 month 
intervals. It cannot be performed on line, and is unlikely to be extendible to 48 months because of 
previous experience within the nuclear industry with tube failures due to stress corrosion cracking 
and aging. The current NRC inspection guidelines for steam generators allow for periods 
between steam generator eddy current testing of up to 40 months. This interval is allowed only 
after two previous successful inspections at shorter intervals. However, because of the difficulty 
planning for a constantly changing inspection interval, most PWR’s opt to inspect all their steam 
generators every refueling outage regardless of the maximum allowable inspection interval. Thus, 
inspection intervals much greater than 24 months which might provide some data as to the long 
term performance of steam generator tubes are rare. Although many of the steam generator tube 
corrosion mechanisms have been virtually eliminated by proper temperature and chemistry 
control, the industry trend is towards more frequent inspections as the steam generators age. 

Many utilities are now replacing their Inconel 600 steam generators with Inconel 690 
steam generators which are supposedly less susceptible to stress corrosion cracking, one of the 
principal steam generator failure mechanism. However, these claims are based upon laboratory 


testing and have not been substantiated by inspection results from actual steam generators. An 
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extensive database of inspection results for Inconel 690 steam generators must be collected 
industry wide before the technical case can be made for increasing the interval between eddy 
current inspections to as much as 48 months. Further research is required in this area, including 
the possible use of state-of-the-art on-line monitoring tools. A program is underway at MIT 
headed by Professor Ronald Ballinger to develop a tool which would provide on-line tube 


integrity information. 


The candidate PWR in preparation for transitioning to a 48 month fuel cycle recently 
completed a draft of a technical request to the NRC to extend the interval between Steam 
Generator tube inspections to 50 months. The technical evaluation concluded that tube 
degradation over the course of 50 months experienced in the type of steam generators used at the 
candidate PWR would not reduce the margins of safety required by NRC Regulatory Guide 1.121 
“Bases for Plugging Degraded PWR Steam Generator Tubes”, August, 1976. The candidate 
PWR uses four Westinghouse Model F with 5626 Thermally Treated, Inconel 600 U-tubes (SB- 
163), hydraulically expanded into the tubesheet at each end. The tube bundle is supported by 
“V-shaped Anti-Vibration Bars in the U-tube bend region and eight stainless steel Tube Support 
Plates.'* If approved by the NRC, it would eliminate eddy current testing as a barrier to an 
extended fuel cycle for those plants with excellent operating history and newer design steam 
generators. To date however, the NRC has not approved any extensions to 50 months. 


Therefore, eddy current testing is likely to remain a barrier for the majority of PWR plants. 


4.3 Investment Protection Category C Surveillances 


4.3.1 Relief Valves 


At the candidate PWR plant there are 23 relief valve surveillances currently performed 
shutdown at intervals less than 48 months. These reliefs cannot be tested on-line, and because of 
their performance history, testing is unlikely to be extendible to 48 months. All! the investment 


protection relief valves are Class 2 relief valves (containment boundary valves). The investment 


'3 Candidate PWR, Technical Evaluation of Extended Inspection Intervals for SBK1 Steam Generator Tubes. 
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protection relief valves are the same design as the regulatory based relief valves. For a more 
detailed discussion of the basis for classifying relief valves in general as Category C surveillances 


refer to section 4.2.1 


4.3.2 Condenser Waterbox Maintenance 


The Main Condenser is the primary heat sink for the power plant. The ability to 
effectively transfer heat to the condenser is vital to the efficient performance of the entire plant. If 
the main condenser heat transfer capability is degraded, either the plant must be operated at 
reduced load or risk overheating and potentially severe damage to the condenser, including 
overpressurization and rupture. 

The primary degradation mechanism of the heat transfer capability of the condenser is the 
clogging of the condenser inlet tube sheets and tubes from either debris or marine growth. Since 
most condensers use brackish water as the cooling medium (seawater, river/lake water), it is 
virtually impossible to totally prevent the buildup of debris or marine growth in the condenser. 
While the onset of reduced heat transfer capability can be delayed by the use of suction screens on 
the piping to the service water pumps, the only proven way to restore or maintain the condenser’s 
heat transfer capability is by opening the condenser and manually cleaning the tube sheet faces and 
lancing the tubes themselves or on-line through the use of chemicals or abrasion balls. Even 
though the main condenser at the candidate PWR has three individual tube bundles which make 
up the main condenser they are not isolable for inspection with the main turbine on the line. 
Therefore, any opening of the condenser waterbox for inspection and cleaning will require the 
turbine and all steam loads to the condenser to be secured. 

At the candidate PWR, the condenser waterboxes are currently cleaned once every 18 
months. Maintenance records and discussions with system engineers indicate that the condensers 
require a thorough cleaning at the 18 month intervals. 

The heat transfer performance of the main condenser can be continuously calculated by 
monitoring the service water temperature changes across the condenser and the main turbine 
vacuum. In this way, plant engineers can determine when the tube sheets are beginning to clog to 


such an extent that they must be cleaned to continue full power operations. At what point this 
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occurs has not yet been determined, and this point may vary depending on the season or makeup 
of the service water source. Even though the candidate PWR condensers currently receive a 
thorough cleaning at 18 month intervals, the condensers have not yet reached the point where a 
degradation in heat transfer capability has occurred, indicating that the performance interval could 
be safely extended past 18 months albeit not necessarily to 48 months. 

One potential solution which may extend the interval between required condenser | 
cleanings would be installation of piping which would allow the individual sections of the 
condensers to be back flushed one at atime. This type of flush could be performed with the 
turbine on-line, and although it would not eliminate all the debris or marine growth buildup in the 
condenser, it might eliminate enough so that the interval between waterbox inspections could be 
extended to 48 months. 

The condenser waterbox maintenance may also be a candidate for performance during a 
reduced power window with the turbine removed from service. If the inspection and cleaning can 
nominally be performed in two to three days it should be considered for on-line performance. The 
economic analysis of Chapter 3, section 3.6.5, considered the impact of on-line performance of 


condenser waterbox maintenance assuming a two to three day performance window as shown in 


figure 3-2. 


4.3.3 Reactor Coolant Pumps 


There are eight reactor coolant pump surveillances which cannot be performed on-line 
because the pumps are not accessible at power, and whose past performance history suggests that 
they cannot be safely extended to 48 months. All eight surveillances deal with the reactor coolant 
pump lube oil system. 

The check of the four reactor coolant pump oil level hi/lo alarm must be performed 
shutdown because the oil system for the reactor coolant pumps are not accessible at power and 
the pumps are required to be shutdown to check the alarms. The check is performed by varying 
the lube oil level in the pump oil reservoir with the reactor coolant pump secured to check the 


operation of the high and low level switches. 
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One possible solution for this surveillance would be to design the pump oil reservoir so 
that it would be accessible with the plant at power. The oil level switches could then be replaced 
with bench tested spares versus varying the actual oil level in the reservoir which would not be 
prudent with the reactor coolant pump running. In this way, the switches could be checked on a 
more frequent basis if necessary, and only then tested in place by varying the lube oil reservoir 
level at 48 month intervals with the pump secured. Additionally, if the lube oil reservoir for the 
pump could be made accessible with the plant at power, a sight glass could be installed to allow 
manual checks of the lube oil level when level switches were removed for replacement. 

The lube oil in the reactor coolant pumps is sampled every 18 months and replaced if 
necessary. Conversations with the reactor coolant pump system engineer indicated that the lube 
oil often requires replacement at 18 month intervals. If an accessible oil reservoir described in the 
paragraph above is installed, lube oil sampling could be accomplished on-line to provide a means 
for determining, on a performance basis, when the lube oil in the reactor coolant pumps required 
replacement. Additionally, consideration should be give to installing an on-line purification 
system similar to those used for most main turbines. The purification system would allow the 
pumps to run for extended periods of time without having to change the oil. Additional oil could 
be added to the pump oil reservoir with the pump running if required. 

Damage to a reactor coolant pump would certainly qualify as one of the major limiting 
plant events. Therefore, until changes are made which would allow on-line purification and 
sampling, shutting down to change the reactor coolant pump lube oil when required, even if it is 


inside of 48 months is the most prudent choice. 


4.4 Summary of Category C Surveillances 


Table 4-1 summarizes the PWR Category C surveillances. Additionally, based on plant 
historical records, estimates of the time required to perform each surveillance is included. 
Because the total time for the plant to be off line would include about a day to establish the plant 
conditions necessary to commence the surveillances and a day to bring the plant back on-line 


following the completion of all the surveillances, the total outage time is likely to be 
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approximately two weeks based on the time to complete the longest surveillance (Eddy Current 


Testing). 
Summary of Category C Surveillances 
Table 4 - 1 
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Chapter 5 - Surveillance Interval Extension Justifications 


5.1. Introduction 


This chapter presents an example of a performance interval extension justification 
conducted as part of an actual 24 month fuel cycle extension program at the candidate PWR. A 
detailed procedure for use in drafting similar interval extension requests to the NRC is provided in 
Appendix A. This procedure, which I drafted, is used as the basis for drafting all 24 month fuel 
cycle interval extension requests at the candidate PWR. The surveillance interval extension 
example provided here is intended to provide a general guide to utilities for use in developing 
justifications for performance interval extension. The example also demonstrates the type of 
effort required to perform a complete 48 month fuel cycle surveillance resolution project. For this 
thesis, complete justification of all candidate surveillances was a prohibitively large task. Because 
actual surveillance resolutions will vary somewhat from plant to plant, a complete surveillance 


justification program is left to the individual utility. 


5.2. Performance Interval Extension Technical Evaluation 


The following technical evaluation for surveillance interval extension was written for 
submission to the licensing department at the candidate PWR as part of an actual 24 month fuel 
cycle extension program. The significant hazards evaluation presented in Section IV of the 
evaluation will form the basis for the formal request for interval extension to the NRC. Although 
written for an extension from 18 to 24 months, the format and methodology used in this technical 
evaluation are applicable to any cycle length. A detailed procedure for completing licensing based 


technical evaluations is enclosed as Appendix A. 
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TECHNICAL EVALUATION NUMBER 5F 
FOR CHANGE TO 
TECHNICAL SPECIFICATION NO. 4.7.3.b 
PRIMARY COMPONENT COOLING WATER SYSTEM 
AUTOMATIC VALVE SURVEILLANCE INTERVAL 


SECTION I - TECHNICAL EVALUATION CONCLUSION 


Technical Specification (T/S) Surveillance Number 4.7.3.6 which is currently performed once per 
18 months, can be performed at surveillance intervals of up to 30 months (24 months + 25%). 
The effect on plant safety is insignificant. Historical preventative and corrective maintenance 
records, surveillance data, other surveillances performed on system components, and a failure 
mode analysis validate this conclusion.. Additionally, the performance of the surveillance at the 
bounding surveillance interval limit (30 months) will not invalidate any assumption in the plant 
licensing basis. 


SECTION Il - DESCRIPTION OF CHANGE 


The PCC automatic valves servicing safety related equipment are demonstrated operable every 18 
months by verifying that each automatic valve servicing safety-related equipment actuates to its 
correct position on its associated Engineered Safety Feature (ESF) actuation signal in accordance 
with T/S No. 4.7.3.b. This change involves increasing the surveillance interval to 30 months (24 
months + 25%) and is associated with plant changes to support 24 month fuel cycle 
implementation. The valves tested by T/S 4.7.3.b are listed in Attachment 1. 


SECTION IIA - OPEN ITEMS DESCRIPTION (Remove when resolved) 


There are approximately 120 MOV’s throughout the plant. There are two off-line MOV 
preventative maintenance items performed at intervals of 36 months or more (multiples of an 18 
month refueling interval) which will be impacted by the move to a 24 month fuel cycle. These 
include: 


(1) Limitorque Actuator Inspections (RF02) 
(2) EQ maintenance for Limitorque operated valves (RF03) 


These surveillances are summarized in Table 1 with their current frequency and the 
associated performance interval in months for both a 18 month and 24 month cycle length. Based 
on conversations with the MOV system engineer, a new recommended performance frequency is 
included which is closest to the performance interval (in months) the system engineer 
recommended for each surveillance. Because the current practice is to perform each surveillance 
on only a portion of the approximately 120 MOV’s during each outage (for example, half for 
RFO2 items, one third for RFO3 items, etc.) there will be some impact on the work scope required 
during a 24 month cycle outage which may either increase the outage length or require more 
manpower to complete with no change in length. These factors will have to be evaluated in the 
context of the whole 24 month fuel cycle project. One option which may help mitigate these 
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factors is the trend towards increased on-line performance of surveillance items. The MOV 
system engineer indicated they are moving in that direction. 
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SECTION DI - EVALUATION OF CHANGE 


The PCC system supplies cooling water for the following components which are needed for plant 
operation or to satisfy one or more basic safety functions: 1.e., to maintain core hat removal, to 
maintain coolant inventory, etc.: 

Containment Spray (CBS) pumps 

Containment Spray Heat Exchangers 

Residual Heat Removal (RHR) Pumps 

RHR Heat Exchangers 

Safety Injection (SI) Pumps 

Centrifugal Charging Pumps 

Containment Enclosure Coolers 

Reactor Coolant Pump (RCP) Thermal Barrier Cooling Heat Exchangers 


The PCC system consists of the RCP Thermal Barrier (RCPTB) loop and two independent flow 
loops, A and B, each of which supplies component cooling water to one of the redundant 
components performing engineered safeguard functions and to the RCPTB loop and to various 
nonsafeguard components. One of the two 100 percent (accident conditions) PCC pumps 
connected in parallel supplies flow to each loop. One PCC heat exchanger in loop A and one in 
loop B transfers the heat loads from the RCPTB loop and plant components to the Service Water 
System. 


A single PCC loop A or B pump providing flow to the PCC heat exchanger in its loop is capable 


of removing the total heat during the recirculation phase following a loss-of-coolant accident 
occurring simultaneously with a loss of offsite electrical power. 
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The following factors related to PCC automatic valve performance over the last three operating 
cycles were considered in evaluating the extension of the surveillance frequency to a maximum of 
30 months: 


e Potential System Failure Modes 

e Surveillance results 

e Corrective maintenance frequency and type 
e Preventative maintenance records 

e System Engineer consultation 


Potential System Failure Modes: Technical Specification Surveillance Number 4.7.3.b tests that 
the PCC valves automatically actuate upon receiving an Engineered Safety Feature signal. 
Potential modes of failure for this surveillance such as valve, sensor, or signal path failure do not 
have time dependent failures that are so short that they would be expected to occur inside of 30 
months, or individual failures can be identified during plant operation through other surveillances 
which are performed on-line on a more frequent basis. The following provides a discussion of 
these items. 


Valve Failure: Valves are tested on-line on a more frequent basis to confirm their operability or 
do not have failure modes that would be expected to occur inside of 30 months. 


The four Motor Operated Valves (MOV) tested by T/S surveillance number 4.7.3.b are stroked 
monthly to check flow through the RHR heat exchangers. They are also time stroked quarterly. 
Periodic stroking ensures electrical power is available to the valve and identifies any valve 
mechanical problems. A review of the performance and trend of the quarterly stroke times of the 
MOV’s showed no time dependent degradation in stroke times and continued proper mechanical 
performance thus supporting an increase in the T/S surveillance interval to at least 30 months. 
Periodic inspection and lubrication of these valves is performed at 36 month intervals and wiil not 
be impacted by a 30 month maximum test interval. 


Piston operated valves CC-V32 and CC-V445 (Spent Fuel Pool Heat Exchanger Isolation) tested 
by T/S surveillance number 4.7.3.b are time stroked quarterly to confirm their operability. The 
quarterly time stroking ensures electrical power is available to the valve and identifies any valve 
mechanical problems. A review of the performance and trend of valve stroke times of these 
piston operated valves showed no time dependent degradation in stroke times and continued 
proper mechanical performance and thus supports an increase in the T/S surveillance interval to at 
least 30 months. 


The remaining 13 valves are all piston operated valves and are only mechanically stroked as part 
of T/S surveillance number 4.7.3.b. A detailed review of historical stroke times of these valves 
was conducted to confirm that electrical power was always available to the valves and that valve 
stroke times were not time dependent on the interval of concern. Valve stroke times were 
reviewed following the initial 12 month refueling cycle and compared to valve stroke times 
following the two 18 month refueling cycles. Valve stroke times were completely independent of 
the interval between stroking. Additionally, all of the stroke times were significantly less than the 
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design basis maximum allowed stroke times. Environmental conditions in the vicinity of these 
valves were also deemed to have a minimal impact on valve performance from the current test 
interval out to the maximum test interval of 30 months. Therefore, although these 13 valves are 
not tested by any other surveillance in the interim between T/S surveillance 4.7.3.6 performance, 
historical test data, environmental conditions, and no time dependent failure modes inside of 30 
months support safe extension of the T/S surveillance interval to a maximum of 30 months on 
these valves. 


Signal Path Failure: The signal path from the instrument to the valves is tested quarterly. The 
quarterly signal path tests confirm that the signal path can safely support the T/S surveillance 
interval extension to a maximum of 30 months. 


Transmitter failure: The transmitters are calibrated at refueling intervals. Redundant transmitter 
channels feed each signal path. A transmitter failure inside of its calibration interval would be 
identified by operating logs review and by comparison to the other redundant instrument channels. 


The potential failure mode review shows that, with the exception of the 13 piston operated valves, 
the entire system is tested on a significantly more frequent basis than T/S 4.7.3.b. Historical 
operating data on the 13 piston operated valves indicates with a high degree of confidence that 
these valves will perform their intended functions at intervals of 30 months. In combination, this 
information shows that there is an insignificant increase in risk by extending the surveillance 
interval to a maximum of 30 months. 


Surveillance Results: Past surveillance test results were reviewed. The surveillance is verified 
by an integrated system test performed by procedure number EX1804.024 Revision 3 (Reference 
1). The system design features worked correctly on all past surveillance tests (Attachment 2). 
Therefore, past surveillance tests support increasing the surveillance interval to 30 months (24 
months +25%). 


Corrective Maintenance Frequency and Type: PCC system corrective maintenance records 
were reviewed (Attachment 3). 54 of the 80 items were identified and corrected prior to initial 
plant operations at 100% power. An additional 10 items were design enhancements to the 
system, leaving only 16 system corrective maintenance items during the four operating cycles. 
During the plant’s operating history there were no corrective maintenance items performed whose 
failures were time dependent. Additionally, none of the items for which corrective maintenance 
was performed would have prevented the valves from performing their design safety function 
upon receipt of an ESF signal. Therefore, corrective maintenance records support surveillance 
extension to 30 months (24 months +25%). 


Preventative Maintenance Records: Review of the PCC system regularly scheduled 
preventative maintenance (PM) activities with a refueling or 18 month interval has concluded that 
there are no PM’s with this interval. All off-line maintenance items have performance intervals, in 
years or refueling multiples, which are greater than 30 months (Attachment 4). Therefore, an 
increase in the T/S surveillance interval to a maximum of 30 months will not impact regularly 





152 





scheduled PM’s on the PCC system, assuming that all the open items listed in section ITA are 
resolved. 


System Engineer Consultation: The PWR PCC System Engineer and the PWR Motor 
Operated Valve Engineer were consulted to verify that the conclusions reached in this evaluation 
are consistent with their knowledge base. The system engineers confirmed that the PCC system 
performance history supports extension of the surveillance interval to 30 months. 


SECTION IV -SIGNIFICANT HAZARDS EVALUATION 





In accordance with 1OCFR50.92, the utility has reviewed the proposed changes and has 
concluded that they do not involve a significant hazards consideration (SHC). The basis for this 
conclusion is that the three criteria of 1OCFR50.92(c) are not compromised. The proposed 
changes do not involve an SHC because the changes would not: 


1. Involve a significant increase in the probability or consequences of an accident previously 
evaluated. 


The proposed change to Surveillance Requirement 4.7.3.b of the PWR’s Technical Specifications 
extends the interval for verifying that each automatic valve servicing safety-related equipment 
actuates to its correct position on its associated Engineered Safety Features (ESF) actuation 
signal. The proposal! would extend the interval from at least once per 18 months/refueling to at 

- least once each refueling interval (nominal 24-months + 25% = 30 months). 


The proposed change does not alter the intent or method by which the surveillance is conducted, 
does not involve any physical changes to the plant, does not alter the way any structure, system, 
or component functions, and does not modify the manner in which the plant is operated. As such, 
the proposed change in the interval of Surveillance Requirement 4.7.3.b will not degrade the 
ability of the PCC system to perform its safety function. Also, the PCC system is designed to 
perform its intended safety function even in the event of a single failure. 


Equipment performance over the last three operating cycles was evaluated to determine the 
impact of extending the interval of Surveillance Requirement 4.7.3.6. This evaluation included a 
review of surveillance results, preventive maintenance records, and the frequency and type of 
corrective maintenance. It concludes that the PCC automatic valves are highly reliable, and that 
there is no indication that the proposed extension could cause deterioration in the condition or 
performance of any of the subject PCC components. 


Since the proposed change only affects the surveillance interval for systems that are used to 
mitigate accidents, the change cannot affect the probability of any previously analyzed accident. 
While the proposed change can lengthen the interval between surveillances, the increase in interval 
has been evaluated and it is concluded that there is no significant impact on the reliability or 
availability of these systems and therefore, there is no impact on the consequences on any 
analyzed accident. 


153 











2. Create the possibility of a new or different kind of accident from any accident previously 
evaluated. 


The proposed change to Surveillance Requirement 4.7.3.b of the PWR’s Technical Specifications 
extends the interval for verifying that each automatic valve servicing safety-related equipment 
actuates to its correct position on its associated Engineered Safety Features (ESF) actuation 
signal. The proposal would extend the interval from at least once per 18 months/refueling to at 
least once each refueling interval (nominal 24-months + 25% = 30 months). 


The proposed change does not alter the intent or method by which the surveillances are 
conducted, does not involve any physical changes to the plant, does not alter the way any 
structure, system, or component functions, and does not modify the manner in which the plant is 
operated. As such, the proposed change cannot create the possibility of a new or different kind of 
accident from any previously evaluated. 


3. Involve a significant reduction in a margin of safety. 


The proposed change to Surveillance Requirement 4.7.3.b of the PWR’s Technical Specifications 
extends the interval for verifying that each automatic valve servicing safety-related equipment 
actuates to its correct position on its associated Engineered Safety Features (ESF) actuation 
signal. The proposal would extend the interval from at least once per 18 months/refueling to at 
least once each refueling interval (nominal 24-months + 25% = 30 months). 


The proposed change to the surveillance interval is still consistent with the basis for the interval 
and the intent or method of performing the surveillance is unchanged. Further, the entire system 
from detectors to valves is either tested on a more frequent basis than T/S 4.7.3.b to confirm its 
operability or previous history of reliability of the PCC system provides assurance that the 
changes will not affect the reliability of the PCC system. Thus, it is concluded that there 1s no 
impact on the margin of safety. 
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Procedure EX1804.024 Revision 3, dated 2/10/94 
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Revision 1, dated 1/4/95 
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_ Updated FSAR Section 9.2.2, Revision 3. 


_ Primary Component Cooling System Annual Performance Reports, 


1990-1994. 


_ Equipment Qualification Manual (SSEQ), Revision 6, dated 


dated 10/18/94. 


_ Harsh Environment Equipment List (1-NHY-300218), Revision 9, 


dated 7/27/95. 


_ Environmental Qualification of Electrical Equipment. EQ File 248-45-01, Revision 2, 


dated 7/27/89. 


_ Operational Test Procedure OX1412.02, PCCW Quarterly 


Operability Test and 18 Month VPI Test. Revision 6, Change 4, dated 7/3/95. 
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ATTACHMENT 1 
PWR TECHNICAL SPECIFICATION 4.7.3.b 
Primary Component Cooling Water 
Automatic Valve Surveillance Interval 
Components Teste 






Phase A 


IC Open to Close 
IC Open to Close 


PCC Isolation from CBS Hx “A” | CC-V137 
PCC Isolation from RHR Hx “A” | CC-V145 


OC Open to Close 
OC Open to Close 
Open to Close 


PCC Isolation to WPB CC-V426 
CC-V427 


OC Open to Close 
OC Open to Close 
IC Open to Close 
IC Open to Close 


PCC Isolation from CBS Hx “B” | CC-V266 
PCC Isolation from RHR Hx “B” | CC-V272 


PCC Isolation to Spent Fuel Pool | CC-V445 Open to Close 
Hx 


PCC Isolation to WPB CC-V447 
PCC Isolation from WPB CC-V448 


Key: CBS - Containment Building Spray IC - Inside Containment 
WPB- Waste Process Building OC- Outside Containment 
RHR- Residual Heat Removal 


Open to Close 
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ATTACHMENT 2 
PWR TECHNICAL SPECIFICATION 4.7.3.b 
Primary Component Cooling Water 
Operations Surveillance History 


18 Month Surveillance Test 
18 Month Surveillance Test | 
18 Month Surveillance Test 
18 Month Surveillance Test 
18 Month Surveillance Test 
18 Month Surveillance Test 
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ATTACHMENT 3 
PWR TECHNICAL SPECIFICATION 4.7.3.b 
Primary Component Cooling Water 
Corrective Maintenance History 


PCC CC-V32 Seat leakage 87W007913 None Installed new seal ring and backup 
| 1/15/88 ring. Retest sat. 


1/27/89 
9/15/89 
Posiseal valves 9/3/91 new EPR seal. 
PCC Air filter polycarbonite bowl is | 88W004149 
cracked and leaking air 1/28/89 Retest sat. 
9/15/89 
cracked and leaking air 2/23/89 Retest sat. 
main control board. 1/8/90 Retest sat. 
outlet. 5/23/94 
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connection. 6/4/88 
CC-V122 Valve fatled type “C” leak test. | 87W005961 None Disassembled valve. Cleaned all 
na 6/23/88 | parts. Assembled with new seal. 
Retest sat. 
handwheel are stripped 7/21/88 Retest sat. 
nort/vent 4/7/89 nipple at valve end. Retest sat. 





| piston cover. 3/23/89 replaced. Retest sat. 
aan ae 
oil. 1/14/88 
3/10/88 auxiliary switch. 
3/13/88 and installed new Raychem. 
Nosition indicator 1/20/89 dlug. 
= when MCB indicates shut. 9/18/91] correct position. 
PCC CC-V137 Replace Tefzel seals in 91W001150 None Replaced existing Tefzel seal with 


ey 

















Readjusted limit by-pass switch, 
replaced cracked limit sw rotor. 
91W004720 Torqued flanges. Minor leakage. 
4/15/94 Replaced gaskets during RFO3. 

87W003965 Thorough inspection, 
5/27/87 measurements and retests sat. 









Removed valve. Flanges out of 








parallel by 3/16”. Retorqued. 
ges still leak 2 drops/min. 


CC-V145 None Replaced flange joint. Flange still 
leaks. Will correct with new 1/4” 
gasket during RFO4. 


CC-V168 Replace Tefzel seals in 86W008862 None Replaced existing Tefzel seal with 
Posiseal valves 1/8/87 new EPR seal. 












94W000121 
4/20/94 


Chronic flange leak. 
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COVIES Cpart 
— see | 87W005717 Replaced handwheel and end cap. 
7/6/87 Retest sat. 
ae handwheel broken. 7/6/87 
8/21/91 Cause of binding unknown. 






PEC - 
PCC - 
PEC - 
2/13/89 414. Retests sat. 
Lieu 2/13/89 414. Retests sat. 
4 Posiseal valves 1/8/87 new EPR seal. 
PCC CC-V256 Modify jack-screws. Modified jack-screws per DCR 87- 
— a | 2/13/89 414. Retests sat. 
ae handwheel. 5/4/88 seal replace. Retest sat. 
| and leaking air. 10/1/88 | 
PCC CC-V256 Replace Tefzel seals in 86W008862 
— oe | Posiseal valves 1/8/87 new EPR seal. 
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aeenetase. 


i : Ate peratic : 
Modify jack-screws. 89W000532 Modified jack-screws per DCR 87- 
2/13/89 414. Retests sat. 
Posiseal valves 1/8/87 new EPR seal. 
P 


C 
C 
PC 





CC-V266 Replace Tefzel seals in 91W001219 None Replaced existing Tefzel seal with 
Posiseal valves 8/22/91 new EPR seal. 


7/27/88 
drain. 8/3 1/9] noted. 
Posiseal valves 8/16/91 new EPR seal. 
8/16/91 
9/19/88 
due to arcing 9/26/92 block during RFO2. 
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12/14/89 
Posiseal valves 8/12/91 
9/12/89 
12/14/89 
Posiseal valves 9/7/91 
Limit switch cycling when 
valve closed. 2/12/93 
12/7/87 
2/14/89 
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Torqued gland bolts. Leakage 
stopped. Cycled valve sat. 


Replaced existing Tefzel seal with 
new EPR seal. 


Removed limit switch and cleaned 
dirty contacts. Retest sat. 
Replaced seal ring, repacked valve. 
NOP retest sat. 

Inspected seats and discs, minor 
scratches cleaned. 





eet rth alata na tate a ees 
eeetereceescereat.oee*, 






‘ata* none! 
‘ana eee 


= LIPEES 
3/8/89 switches. Retests sat. 
3/28/89 unsat on 447. 
PCG CC-V447 Disassemble and inspect valve 
for seat leakage problem. 5/17/89 Worked valve. Retests sat. 
Posiseal valves 8/20/91 new EPR seal. 
10/28/89 









1/18/88 Retests sat. | 
11/23/87 bolts. Inservice leak test sat. | 
Posiseal valves 8/15/91 new EPR seal. 
10/28/89 
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ATTACHMENT 4 
PWR TECHNICAL SPECIFICATION 4.7.3.b 
Primary Component Cooling Water 
Off-Line Automatic Valve Preventative Maintenance 





1S0603.005 


Note: RF refers to a refueling interval. The number following indicates the frequency of performance. For example, RFO2 is 


performed every second refueling. 
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Chapter 6 - A Framework for Reducing Forced Outage Rates 


6.1 Introduction 


The primary focus of this thesis is the development and application of a strategy for 
resolving a power plant’s surveillance program to minimize refueling and planned maintenance 
outage times during extended fuel cycles. In doing this, the two primary goals of the thesis were 
met. The thesis demonstrated that, with the exception of the Category C surveillances of Chpater 
4 the regulatory and investment protection barriers to extended cycle lengths perhaps can be 
overcome, and it provided a systematic surveillance resolution procedure that utilities can use to 
prepare for extended cycle lengths. The two other key issues discussed in Chapter 1 that must be 
addressed to make extended fuel cycles attractive to the nuclear industry are increasing the cycle 


length between refuelings through improved core designs, and reducing forced outages rates. 


Forced outages, as defined here, include any unplanned outages during an operating cycle. 
This includes plant trips and short term controlled shutdowns to complete any unexpected repairs. 
Forced outages are primarily caused by either equipment failure or human error. The impact of 
human error on forced outages is difficult to quantify but has been estimated to account for as 
much as 20% of the overall forced outage rate.'* This is because many forced outages which on 
the surface appear to be due to component failure actually have human error as their root cause. 
For example, a plant trip caused by a loss of a main feed pump governor control valve will often 
be reported as a main feed pump failure. Yet, further investigation of the failure might show that 
the governor system failed because the wrong type of fastener was used in assembling the 
governor during the last outage. So although an equipment failure caused the forced outage, the 
fact that the mechanical failure was caused by improper maintenance means that the forced outage 
was in reality caused by human error. The distinction is vitally important when attempting to 
reduce the forced outage rates for extended fuel cycles. Since the possibility of human error 


always exists, increasing the number or frequency of surveillances or maintenance items will 


' Conversation with Dr. Chong Chiu, San Onofre, June 1995 at the MIT Summer Reactor Safety Seminar. 
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always tend to increase the forced outage rate due to human error. Conversely, reducing the 
number and frequency of surveillances or maintenance items will reduce the forced outage rates 
due to human error. The key then is to determine the optimum types and frequency of 
surveillances and maintenance such that the combination of forced outage rates from equipment 


failure and human error are minimized. This topic will form the basis for significant future work. 


Because quantifying and reducing the impact of human error on the plant force outage rate 
is extremely difficult, a different approach is taken towards the goal of reducing forced outages to 
less than 3%’ (~40 days) during a 48 month fuel cycle. This approach focuses almost exclusively 
- on understanding and reducing component root causes of failure as the best way to improve 
individual component reliability. By improving component reliability there will be an indirect 
reduction of the impact of human error on plant forced outage rates because more reliable 
equipment will require less maintenance and testing. Reducing the amount of maintenance and 
testing means less human involvement, and thus less chance of introducing human error. The 
question then that must be answered is “Can the component be expected to run reliably for at 
least 48 months with no maintenance which requires the component to be removed from service?” 
If the answer to that question is yes, then the interval between surveillances or maintenance is at 


least 48 months and the component will not pose a barrier to an extended fuel cycle. 


Li and Golay’® determined for the Condensate-Feedwater System that to achieve a 97% 
system capacity factor (3% forced outage rate), the overall independent component mean time to 
failure must be approximately 10°/hr or better if no repair time is considered as shown in figure 6- 
1 at point A. Figure 6-1 shows that if repair is also considered, and the average repair time 1s 
1000 hours (~40 days) then the allowable failure rate of the component is 2x10°/hr as shown at 
point B. If average repair times are reduced to 100 hours (~4 days), then allowable component 
failure rate is 2x10/hr as shown at point C. Therefore, if component failure rates are determined 
to be 10°/hr or better, no further improvements to the components performance is required to 


make it compatible with a 48 month fuel cycle. These analyses neglect the effects of common 


'5 The 3% goal is based on the probable U.S. utility industry forced outage rate taget for the year 2000. 
'® Golay, Michael, and Li, Feng, “Results Summary from Reliability Sensitivity Analysis for a PWR Condensate- 
.Feedwater System”, May 1996, 
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cause failure. For component failure rates which do not meet the 10°/hr target, two options exist 
to reach the 97% system capacity factor goal. First, the component could be improved to reach 
the 10°/hr failure rate target independent of repair, or second, the component failure rate and the 
average time to repair could both be improved so that in combination they meet the 97% system 
capacity factor goal. Both options should be explored in detail and the most economic plan 
chosen. Note that this study assumed that the rest of the plant did not contribute to the overall 
forced outage rate. Therefore, the actual failure rates needed to achieve a plant capacity factor of 


97% will be somewhat higher than the values stated here. 


Allowable Failure Rates of Active Components Needed to 


Achieve a Component 97% Capacity Factor with Various Repair Times 


Figure 6 - 1"’ 


0.6] - 


0.4] - 


Average Capacity Factor of System 





A B: 
slo." 1-10. 110 - 1°10. 1¢10- 0.001 


Failure Rate of Active Components, 1/hr 


——~ No repair 

-* Repair rate of active components: 10E-1 /hr 

“+ Repair rate of active components: 1OE-2 /hr 
Repair rate of active components: 10E-3 /hr 


Because passive components such as heat exchangers are typically considered to have 
failure rates which are already at least 10°/hr or better, the components that should be examined 


first are components where: 


'’ Li, Feng, and Golay, Michael, "Results Summary from Reliability Sensitivity Analysis for a PWR Condensate- 
Feedwater System", Department of Nuclear Engineering, Massachusetts Institute of Technology, May 1996, p. 16. 
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e Failure will result in a reactor trip or shutdown and where, 
e No redundancy exists when the plant is operating at rated power 


Fortunately, there are very few components at a typical PWR that meet these two criteria. 
These include the Reactor Coolant Pumps of which there are typically four per plant, the Main 
Turbine and Generator of which there is typically only one, the Main Feed Pumps (MFP) of which 
there are typically two, and selected portions of the Electrical Distribution and Reactor Protective 


Systems. 


A 1994 study by Yankee Atomic entitled "Operational Reliability Analysis of Seabrook 
Station", November 1994, concluded from a review more than 900 Westinghouse NSSS system 
trip experiences between 1985 to mid-1993 that the following components or systems had the 
largest contribution to the overall plant forced outage rate and were the driving factors in overall 


plant reliability: 
e Turbine Generator and Turbine Generator Controls 
e Feedwater and Feedwater Controls 
e Electrical Distribution 


e Reactor Protection” 


Because of these results, these types of components should be studied first in an overall 
strategy to reduced plant forced outage rates below 3%. The overall strategy for reducing forced 


outage rates must address the following key issues: 
e Current component or system reliability levels 
e Major component/system failure mechanisms and their root causes 


e Current surveillance program’s impact on overall component or system reliability 


'8 O'Regan, Patrick J., "Operational Reliability Analysis of Seabrook Station", Yankee Atomic Energy Corporation 
. Contract 1880, November 1994. p. 23. 
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Of the components discussed previously, the MFP was chosen as the initial candidate to 
study in detail because of its relative simplicity and because of the access to data and the 
personnel necessary to conduct the research. This chapter begins the work necessary to answer 
the question of whether the MFP can be expected to run reliably without being shutdown for at 
least 48 months. It includes research on the root causes of MFP failures, as well as interviews 
with industry personnel, maintenance and diagnostic experts, pump consultants, vendors, and 
manufacturers of significant pump sub-systems such as mechanical seals. While not providing the 
final answer to the question of whether the MFP will run reliably for at least 48 months, this 
chapter lays the groundwork and direction for future work on the MFP as well as a framework for 


investigating other key plant components such as those mentioned in the preceding paragraph. 


6.2 Estimates of Current Main Feed Pump Reliability 


The first step in reducing forced outage rates is to determine as accurately as possible the 
current reliability levels of the component or system independent of repair. This is vital to 
understanding the component or systems contribution to the overall plant forced outage rate as 
well as providing a starting point for determining how much reliability improvement in the 
component or system is needed to meet the goal of an overall plant forced outage rate of no more 
than 3%. 

The first step in determining the current reliability levels of the MFP was a review of 
Westinghouse Plant Licensee Event Reports (LER), written from 1985 to 1993, which reported 
the cause of plant shutdown as the Feedwater System. This review, conducted as part of a 1994 
single component failure study at the candidate PWR found 250 LER’s which reported the cause 
of plant shutdown as the Feedwater System. These 250 LER’s were then further broken down by 
the author of this thesis. The event description of each LER was examined to determine the 
actual cause of the shutdown. Shutdowns caused by component failure which were the result of 
improper maintenance or installation were classified as human errors. Of the 250 Feedwater 
System LER’s which caused shutdowns, 55 were attributable to the Main Feed Pump. These 55 
LER’s were further broken down by their root causes. The causes and the number of occurrences 


of each are shown in table 6-1. 
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LER Reported Causes of MFP Failures (1985-1993) 
Leading to Plant Trips 


Table 6 - 1 







3 


] 
Speed Control System 18 
Lube Oil 15 

l 


Vibration 
Valves Associated with Pump 





i, 





There are 77 PWR plants in the United States. It was assumed that the plants on average 
had two MFP’s each for a total of 144 pumps in the study. It was also assumed, based on 
discussions with plant engineers that MFP’s were operational 75% of the time over the course of 
the nine years studied. Note that this 75% is not the plant capacity factor, but an estimate of the 
average operating time of the Main Feed Pump during the course of a year. Based on this 


information, a first estimate of the MFP failure rate was calculated. 


MFP Failure Rate = 55 failures/(144 pumps*9 years*365.25d/yr*24hr/day*.75) 
6.46*10°/hr 


This initial estimate of the MFP failure rate is close to the value of 10°/hr needed to 
support the goal of a system 97% capacity factor assuming no repairs are considered. Improving 
the reliability of the MFP by a factor of about six 1s needed to meet the project goals assuming no 
repair. Although the case of no repair is artificial, 1t does provide an excellent target for 
improving component reliability. Ifa component’s reliability can be economically improved to the 
point where it meets target capacity factor goals without repair, it will clearly support capacity 
factor goals if repair is allowed. 


A second and possibly more accurate estimate of MFP failure rates was obtained through 


a search of the Nuclear Plant Reliability Data System (NPRDS). This search revealed 205 events 


17] 











caused by MFP’s that resulted in either a plant trip, plant shutdown, or a reduction in power. 
This data was over approximately the same time period as the LER trip history data, but includes 
all 110 licensed power plants (both PWR and BWR) in the United States. The leading causes of 
MFP failures from this search are as shown in Figure 6-2. 


NPRDS Leading Causes of MFP Failures 
Figure 6 - 2 


Percent of Total Failures 





Bearings Seals Control Systems All Others 


Cause of Failure 


Using the NPRDS results, one obtains an estimated failure rate of: 
MFP failure rate = 205/(220 pumps*9 years*365.25d/yr*24hr/day*.75) 
1.57x10°/hr 


Although this failure rate is almost two and one-half times greater than the first calculated 
failure rate, it is important to remember that more than 75% of the MFP failures reported tn the 
NPRDS system did not require the plant to be shutdown. Most of the repairs were conducted 
with the plants at powers ranging from 50% to 67%, depending on the number and capacity of the 
remaining pumps available. Thus, while the overall failure rate is somewhat higher, its overall 
impact on the plant capacity factor is probably smaller because the plants retain the capability to 
produce power during the course of many of these MFP repairs. 

In order to get an estimate for the average outage times following a trip caused by a MFP 
failure, a review was conducted of the database maintained by the NRC which documents plant 


performance. From 1989 to mid-1995 there were a total of 24 forced outages industry-wide 
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caused by problems with a MFP. The average outage hours for these 24 events was 51.3 hours. 
Using this as an estimate of the average repair time for MFP failures and referring back to figure 
6-1, one obtains an allowable MFP failure rate of about 3x10“/hr needed to achieve a system 97% 
capacity factor. 

These initial estimates of the current MFP reliability demonstrate that the MFP reliability 
levels are probably already very close to the point where they could reliably support extended 
cycles of 48 months. The results of all these calculations are summarized in table 6-2 below. 
However, even though initial reliability estimates may demonstrate that a component could be 
expected to operate reliably over an extended cycle, further component reliability improvements 
should be pursued. The 3% forced outage goal is the upper limit on acceptable forced outage 
rates. If additional economic reliability improvements can be made to a component which will 
contribute to even lower forced outage rates, they should be strongly considered. Additionally, 
maximizing the reliability of individual components will also help offset the impact of any 
components whose reliability levels cannot be economically improved. Therefore, further sections 
in this Chapter will focus on the root causes of failures of MFP’s and address some of the 


recommended design, installation, and operational techniques to improve MFP performance. 


Summary of MFP Failure Rate Estimates 
Table 6 - 2 


LER Review of Main Feed Pump Trips 6.46 E-6 (Calculated) 
o Repairs Assumed 


NPRDS Review of all MFP Trips, Shutdowns, Power 
Reductions (No Repairs Assumed 
Allowable MFP Failure Rates Given a 3.0 E-4 (Allowed) 
50 Hour Average Repair Time 
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6.3 Root Causes of Main Feed Pump Failures 


6.3.1 Introduction 


Based on the service requirements for main feed pumps used in the nuclear industry, they 
should exhibit very high reliability levels. Because nuclear power plants operate at much lower 
temperatures than fossil plants, very high steam flow rates are required to the turbine generators 
to deliver the steam energy necessary to produce large amounts of power, on the order of as 
much as 1200 MWe. These high mass flow rates result in the need for feed pumps which have 
very high capacity but much lower head requirements than those required for fossil plants. These 
requirements are typically met with a single stage, high capacity, high speed pump. Most plants 
use two 50% capacity pumps, with some of the older designs using three 50% pumps. The single 
stage pump means that the impeller shaft is shorter and thus the bearing spans are much closer 
than a typical fossil plant MFP. The shorter bearing spans typically mean more even load 
distributions on the bearings and thus longer life. The shorter shafts also mean that there is less 
flexing in the shaft, resulting in a lower likelihood of misalignment and vibration, two of the 
leading causes of impeller, bearing, or seal failures. Additionally, nuclear plants are most often 
operated at rated power as opposed to commercial fossil plants which are typically operated ona 
cycling or load following mode based on the local grids demand. Because of this, nuclear feed 
pumps should be able to operate for longer periods closer to their best efficiency point (BEP) as 
illustrated in figure 6-3 below. 

Figure 6-3 shows the combination of flow and pump head which result in the pump 
Operating at its Best Efficiency Point (BEP). Operating at the BEP is important not only because 
it represents the maximum hydraulic efficiency point, and thus requires the least energy to run the 
pump, but also because operations at this point are known to result in the most most efficient flow 
streams within the pump. The most efficient flow streams result in the lowest possible dynamic 
stresses in the pump and various pump components, lower risk of cavitation, and therefore longer 


lifetimes for pump components as well as reduced maintenance.” 


'° Feedpump Operation and Design Guidelines - Summary Report. Prepared by Sulzer Brothers Limited, 
_:Winterthur, Switzerland for the Electric Power Research Institute. Final Report, June 1993., pgs. 1-7. 
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Main Feed Pump Operating Curves 


Figure 6 - 3 


Max Efficiency 


Pump Curve | 
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System Curve 


Best Efficiency Pt 
Head 


Flow 


Given these inherent advantages, the MFPs used in the nuclear industry should exhibit 
significantly higher reliability levels than their fossil counterparts. However, in general this is not 
the case. The American Electric Power Company (AEPC), for instance, uses only one, multi- 
stage, 70,000 horsepower feed pump for their 1300 MWe fossil plant designs. These pumps 
which have historical availabilities of around 99% match or exceed the availabilities of most of the 
MFPs used in the nuclear industry. AEPC feed pumps must be reliable or their plants cannot 
operate, and they are. 

The remaining portions of this chapter will focus on the major failure mechanisms 
exhibited by nuclear MFPs, their principal root causes, and some general recommendations for 
how to reduce the particular failure mechanism. Based on conversations with many pump experts 
ranging from vendors to plant engineers, most of the pump failure mechanisms and many of their 
root causes of failure are already fairly well understood. In many cases, there are also detailed 
recommendations for how to reduce these failures. However, the detailed understanding of the 
root causes of failures and potential solutions for their elimination does not appear to be 
incorporated into the day to day maintenance and operations of the pumps. Most importantly, 
despite all the knowledge that exists on pump design and operation, it does not appear that there 
has been a serious effort to make a quantitative connection between recommended solutions and 


subsequent improvements in pump reliability. For example, how much more reliably would a 
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MEP run if it was always operated at its best efficiency point (BEP)? What are the quantitative 
reliability trade-offs from operating to the left or right of the BEP as shown at points B and C on 


figure 6-4? 


Other Main Feed Pump Operating Points 


Figure 6 - 4 


Pump Curve 2 Max Efficiency 










ysystem Curve 


BEP 
Head 


Flow 


As another example, the industry today is using more and more sophisticated monitoring 
and diagnostic equipment to monitor feed pump performance. These new systems are estimated 
to cost about $50,000 per pump to install, not to mention the costs of training people in how to 
use the equipment. Yet, no one interviewed could conclusively say what the quantitative 
reliability gains would be from using this type of equipment. In an age of increased competition, 
utilities must understand the cost benefits of their engineering options. Quantifying the reliability 
gains from various options typically employed to improve pump reliability should form the basis 


for significant future study within the industry. 


6.3.2 Major Failure Mechanisms and Root Cause Discussion 

Figure 6-5 contains a simplified diagram which summarizes the principal failure 
mechanisms and their root causes for MFP’s. The diagram was developed based on a review of 
NPRDS failure data, LER’s, and discussions with experts in the main feed pump field. The 


number or letter associated with each box allows for a ready classification scheme that could be 
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applied to all MFP failures and placed in a database for analysis. For instance a MFP failure 
caused by seal leakage, where the seal failed due to vibration caused by an initial misalignment of 
the pump would be classified as A.1.a.1. 

Two root causes which were not included in Figure 6-5 were failure due to normal wear 
and failure due to human error. These root causes accounted for 58 of the 205 (28%) MFP 
failures reported in NPRDS which resulted in a plant trip, shutdown, or power reduction. This 
includes 40 of 205 (19.5%) which were attributed to normal wear and 18 of 205 (8.7%) which 
were attributed to human error. However, based on a review of plant material history, pump 
maintenance schedules, and discussions with pump experts, it is likely that the expected lifetime of 
components such as bearings, seals, pump impellers, and wearing rings, subject to normal wear 1S 
well in excess of 48 months and therefore should not adversely impact on pump reliability levels 
during a 48 month cycle. Also, as noted in the beginning of this chapter, this study does not 
attempt to correct failures resulting from human error with the exception of that by reducing the 
maintenance intervals of plant components, that part of the total failure rate due to human error 1s 


reduced. 


6.3.2.1 Major Failure Mechanisms 


6.3.2.1.1 Seals 


Seal failures accounted for the largest number of MFP reported failures. Of the 205 
reported MFP failures, 70 were caused by seal failures. Seal failures were reported as being most 
often caused by improper installation, misalignment, vibration, material deficiencies, and debris 
injected into the seal. By far, the largest contributor to seal failure was dirt or debris injected into 
the seal area resulting in scoring or clogging of the seal area. The scoring of the seal results in 
uneven pressure distributions across the seal faces which ultimately leads to leakage. Debris in 
the seal area can also reduce the amount of cooling water to the seals resulting in seal 


overheating, distortion, damage, and ultimately leakage. Maintaining clean flush water at the 





proper pressures and flow is vital to long term seal performance. 
Two of the major seal types used on feed pumps are throttle bushing seals and mechanical 


seals. Throttle bushings are used on most fossil industry MFPs and some PWR MFPs. They 
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Main Feed Pump Failure Diagram 


Figure 6-5 
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have a history of very reliable long-term performance but have several disadvantages. First, they 
generally have much higher leak rates than mechanical seals and may require special drains. The 
leakage results in larger makeup quantities of expensive feedwater. They also require close 
clearances which are difficult to achieve and therefore costly. Finally, for nuclear power plants, 
the leakage, especially at Boiling Water Reactors, may be a radiological concern. At most 
PWR’, throttle bushing leakage is more a makeup water concern than it is a radiological concern. 

Mechanical seals come in a variety of designs. The major advantage of mechanical seals 1s 
that they are relatively leak free. Mechanical seals have a wide variety of applications and are 
widely used in the chemical and oil industry where pumps are required to pump fluids which are 
very dangerous to humans and the environment and for which little to no leakage can be allowed. 
They are often used in Boiling Water Reactors, where the water in the feed system is 
contaminated and less leakage is allowed. They are also used in many instances in PWR MFPs. 
Based on discussions with a leading seal manufacturer, mechanical seals have a typical service life 
of six to eight years when installed properly and operated under design conditions. The most 
common type of seals used for feed pump applications are balanced, pusher, rotating seat seals. A 
rotating seal face of antimony filled carbon bearing upon reaction bonded silicon carbide offers the 
best combination of seal wear, corrosion characteristics, and thermal conductivity.” 

A survey of seal failures in the United States by one of the world’s largest seal 
manufacturers”' found that the principal causes of mechanical seal failures were: 

e 40% Operational Problems - caused by items such as flow interruptions 

e 24% Mechanical Difficulties - caused by assembly errors, incorrect clearances, 

inadequate alignment 
e 19% Faulty Fluid Circuit Design - caused by insufficient suction, deficient flush circuit, 
and pumps unsuitable for the design service conditions 
e 9% Poor Seal Selection - caused by the wrong materials or wrong configuration 


© 8% Other 


20 Presentation to the MIT Extended Cycle Project Group by Steve Jambor of John Crane, Inc., 24 April 1996, p. 
80. 
*! Crane, p. 66. 
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6.3.2.1.2 Bearings 


Bearing failures accounted for the second largest number of MFP reported failures. Of the 
205 reported MFP failures, 35 were caused by bearing failures. The principal causes of bearing 
failure were misalignment or vibration in the pump causing excess bearing loads, and lube oil 
system related problems. Lube oil system related problems were reported as being principally 
caused by two major factors. First, contaminants in the oil (water or debris) which can damage 
bearing faces or reduce cooling to the bearing. Second, a complete loss of lube oil to the bearing 
which results in a short term catastrophic failure of the bearing babbit surfaces. 

- One attractive alternative currently being explored is the use of magnetic bearings. 
Magnetic bearings are self-aligning and require no lube oil, the leading cause of bearing failure. 
The U.S. Navy has started to use these types of bearings on their turbine generators and the 
Electric Power Research Institute (EPRI) is currently investigating their use on a wide range of 
pumps and turbines. The major drawback of magnetic bearings is that they are relatively 
expensive and would require equipment modifications to backfit them into existing components 


including the MFP. 


6.3.2.1.3 Control Systems 


Control systems were the third leading reported cause of MFP failures accounting for 20 
of the 205 MFP failures which resulted in a plant trip, plant shutdown, or reduction in power. 
Additionally, control system failures were the cause of 18 of the 55 trips associated with MFP’s in 
the review of LER feedwater system trips between 1985 and 1993. The principal cause of control 
system failures was problems associated with the lube oil. Similar to the bearing problems 


discussed above, loss of oil or loss of oil cleanliness was the root cause of control system failures. 


180 











6.3.2.1.4 Pump Structures 

Unlike the other failure mechanisms discussed previously, pump structures are not as 
significant a contributor to the overall failure rate of the MFP, accounting for 16 of the 205 
reported MFP failures which caused a plant trip, shutdown, or reduction in power. Pump 
structures include the pump shaft, impeller, and casing. These failure mechanisms are important 
though because of their impact on the plant capacity factor. Failures of the pump structure 
typically result in more severe damage to the pump. This generally causes the cost and time to 
repair the pump to be higher for this type of failure than any other kind. Most of the casing and 
- shaft damage is the result of poor manufacturing techniques. The principal causes of impeller 
damage are vibration caused by pump misalignment, operation of the pump for significant periods 


of time at other than design conditions, and cavitation caused by insufficient suction pressures. 


6.3.2.2 Major Root Causes of Failure 

Based on research of MFP material records and discussions with pump experts there 
appears to be three major root causes of MFP failures. These include: 

e Vibration Induced Failures 

e System Cleanliness Failures 


e Pump or System Design Failures 


Each of these areas is discussed in more detail in the following sections. 


6.3.2.2.1 Vibration Induced Failures 


Vibration is probably the leading cause of failure in all types of rotating machinery 
including MFP’s. Often vibration failures show up as failures in bearings, seals, or other pump 
internals. Vibration was the root cause of failure in 55 of the 205 MFP failures studied. Vibration 
is primarily caused by three major areas, misalignment, improper design, and operation of the 


pump at other than design conditions. 
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Misalignment can be caused by several factors. The first is obviously from an initial 
misalignment of the pump during installation or following repair. This can occur as a result of 
operator error, but is most likely the result of not accounting for the alignment differences when 
the pump is hot and cold. Proper alignment procedures should include both a cold and hot 
alignment, with the hot alignment being the most vital since this is the condition where the pump 
is most often operated. Advanced optical alignment techniques are available to assist technicians, 
but many pump experts say that these tools are not any better than the older reverse dial indicator 
method of pump alignment. 

Misalignment can also be caused by nozzle loading. This is especially a problem in the 
nuclear industry where the large flow rates of the pumps requires very large suction and discharge 
piping. This piping, also experiences thermal expansion during plant heatup, and if not properly 
anchored or designed to allow for expansion will transmit nozzle loads to the pump which will 
move the pump out of alignment. Essentially, the pump should not be used as the anchor point 
for its suction and discharge piping. One leading pump manufacturer stated that solving the 
nozzle load issue was the critical factor in the long term reliable operation of nuclear MFP’s. 

The coupling between the pump and its driver is also a critical factor in the misalignment 
of MFP’s. Couplings should be designed to absorb some misalignment differences between the 
pump and the driver. However, couplings which are designed to handle the largest amount of 
misalignment are not well suited to the high loads and high speeds required of the MFP’s used in 
the nuclear industry. Several of the coupling failures found in the research were due to 
inadequate lubrication of the coupling itself. 

Finally, thermal effects play a large role in MFP misalignment. Thermal effects manifest 
themselves in increased nozzle loads, but also play a major role in the misalignment of pumps 
which are improperly mounted. MFP’s should be center mounted with the driver hard mounted 
to the foundation and the pump free to move axially on a sliding foot. Failure to properly 
lubricate this sliding foot area can result in pump misalignments due to thermal effects. 

Improper design of the pump is also a leading cause of MFP vibration. There are too 
many areas of pump design which have the goal of reducing pump vibration to discuss here. 


However, there are two significant areas which warrant a brief discussion. 
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The first is the adjustment of the two gaps at the impeller periphery. The first gap, 
generally referred to as the “A” gap, is the gap between the sidewall of the pump casing and the 
impeller itself. This gap should be made as small as possible to prevent high pressure water at the 
impeller discharge from leaking back to the suction side of the pump. This leakage sets up 
recirculations in the pump which cause vibrations. However, reducing the “A” gap means that the 
clearances are so small that any misalignment of the pump will result in premature wearing of the 
pump wearing rings, setting up higher recirculation levels and thus more vibration. The second 
gap, commonly referred to as the “B” gap, is the gap between the impeller leading edge and 
diffuser or volute at the outlet to the pump. This gap should be increased to reduce the intensity 
of the interaction between the impeller and the diffuser or volute. Increasing this gap from three 
percent to five percent of impeller radius reduces the pressure pulsations and loads which cause 
vibration by more than half. However, increasing the “B” gap too much will result in a loss of 
pump efficiency.” 

The second important design consideration in reducing the vibration levels of the MFP ts 
to design the MFP so that it’s best efficiency point corresponds to the normal operating 
conditions of the plant. As was stated previously, operations at this point are known to result in 
the lowest dynamic stresses in the pump and various pump components, lower risk of cavitation, 
and therefore longer lifetimes for pump components as well as reduced maintenance. However, 
most nuclear feed pumps are designed with additional flow margins because of safety 
considerations. Many plants were also originally designed with extra flow capability in case the 
plant wanted to upgrade the rated capacity of the plant at some later date. Both of these 
considerations result in MFP’s whose BEP is not at the normal operating conditions of the pump. 
- This condition can be corrected by “tuning” the pump. Tuning the pump involves shaving the 
impeller to change the pump characteristics so that the pump is operating at BEP at the normal 
operating conditions of the plant. Utility managers and plant designers should consider the trade- 


offs in increased pump reliability with the need for rarely used higher capacity capabilities. 


?2 Cooper, Paul, Wotring, Timothy, and Makay, Elemer, “Minimum Continuous Stable Flow in Feed Pumps”. 


Ingersoll Rand Company, p. 2. 


183 











Pump operation is the last major contributor to vibration. Pump operation is analogous to 
the design issues surrounding BEP. Even if the pump is designed so that normal operations are 
not at the pump’s BEP, operators should attempt to get as close as possible to BEP. This means 
that multiple MFP’s should not be run at low demand conditions where only one MFP is required 
and that pump start ups should occur expeditiously while meeting all pump heatup requirements 


to minimize the time spent at low unstable flow conditions. 


6.3.2.2.2 System Cleanliness Induced Failures 


One of the leading causes, yet simplest root causes of failure is a lack of system cleanliness 
principally in lube oil or seal flushing systems. System cleanliness problems were the root cause 
of MFP failure in 35 of 205 MFP NPRDS failures which resulted in a plant trip, plant shutdown, 
or power reduction. While relatively simple to fix, cleanliness issues require constant attention. 
Lube oil system cleanliness can be improved through the use of filters and in-line purification 
systems. Seal water cleanliness can be improved through proper chemistry control and the proper 


pressure and flow rates to the seals. 


6.3.2.3 Summary of MFP Root Causes of Failure 


Table 6-3 provides a summary of the major root causes of 205 NPRDS MFP failures 


which caused a plant trip, shutdown, or reduction in power. 


Summary of MFP Root Causes of Failure 
Table 6 - 3 






Salaetetalatatatatatatat yrerarerenarelalerererersteretararatatatatetetetetats 
wleletetetatated . 
ctatataratetete 











ee i ae ee ee. ee mS Cay 


Resatenta € persis SF 


a i. Pe ROO ater elena 
rere aietetet . See he a Os & Ly 


184 











The principal recommendations for reducing these root causes of failure and maximizing 


the reliability of the MFP with the minimum cost include : 


Maintain system cleanliness in both lube oil and seal systems through daily attention to 
detail 

Reduce vibration by operating the MFP as close as possible to its Best Efficiency Point 
Perform proper hot and cold alignments of the MFP, check alignment frequently 
Check to ensure that the MFP is not being used as the anchor for suction and 
discharge piping and correct if possible 

Check to ensure that the pump is mounted on its foundation properly and that sliding 


feet are lubricated 


There are several other recommendations which are design based or require some cost to 


implement. These include: 


Install the proper seals. Balanced, pusher, rotating seat seals with seal faces of 
Antimony filled carbon bearing upon reaction bonded silicon carbide offer the best 
combination of characterstics for MFP mechanical seals. 

Consider the installation of magnetic bearings if the backfit cost is not too high. 
Involve pipe and pump designers with plant engineers to reduce nozzle loading to the 
maximum extent possible. 

Consult with the plant MFP vendor to establish the optimum “A” and “B” gap 
clearances in the MFP. 

Tune the pump impeller to match the pump BEP with the normal plant operating 
conditions. 

Ensure plant operating procedures mandate the optimum combination of MFPs for the 


entire range of plant operating conditions. 


6.4 Main Feed Pump Surveillance Program 


The last of the three key issues that must be addressed in any overall strategy for reducing 


component or system forced outage rates is the component’s current surveillance program. 
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Surveillance programs should be studied to determine if the surveillances that must be performed 
with the component secured at intervals less than 48 months directly impact on the operation of 
the component, or whether these surveillance’s main purpose is to ensure that protective devices 
and alarms for the component are functional. In the first case, as in the replacement of a pump 
impeller, these surveillances and their intervals have a direct impact on the reliability levels and 
forced outage rate contribution of the component or system. In the latter case, as in the case of 
the calibration of the MFP low suction trip, the surveillance performance is meant to aid in 
protecting the component or system from severe damage, but will not necessarily improve the 
overall reliability of the component. Table 6-4 provides a summary of the surveillances at the 
candidate PWR which are currently performed shutdown on the MFP at intervals less than 48 
months. Note that all these surveillances have been previously resolved to either on-line 


performance or performance at 48 month intervals in Chapter 3. 


Surveillances Currently Requiring MFP Shutdown 
Table 6 - 4 


Turbi 
Trips 


Emergency Oil Pump Pressure Switch 


Calibration 

Pressure Alarms and Speed Indication 
Turbine Trip Header Oil Pressure 
Calibration 





As can be seen from Table 6-4, all the surveillances performed inside of 48 month on the 
MFP at the candidate PWR are performed to ensure a control system is in calibration. This does 


not imply that these surveillances are unimportant. What it does mean, 1s that assuming all the 
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control surveillances remain in calibration, the pump is already expected to run reliably for at least 
48 months based on the fact that there are no surveillances which replace or inspect major MFP 
components at intervals less than 48 months. Since all the control surveillances listed in Table 6-4 
were previously resolved to a 48 month cycle, the surveillance program supports the contention 


that the MFP can be expected to run reliably for at least 48 months. 


6.5 Summary of the Framework for Reducing Forced Outage Rates 


This chapter has developed a framework for reducing forced outage rates of key plant 
components and applied that framework to the Main Feed Pump. The key areas that must be 
addressed in reducing component or system forced outage rates are: 


e Current component or system reliability levels 
e Major component/system failure mechanisms and their root causes 
e Current surveillance program’s impact on overall component or system reliability 


For the Main Feed Pump, currently reliability levels were estimated using both LER trip 
history and NPRDS MFP plant trips, plant shutdowns, and power reductions. Average outage 
times for outages caused by MFP’s were obtained from the NRC’s outage database as an estimate 
of the average time to repair following a MFP failure. Based on this data, the MFP could be 
expected to run reliably for 48 months. This is further supported by an examination of the 
candidate PWR’s MFP surveillance program. There are no surveillances performed on the MFP 
which replace or inspect major pump components at intervals of less than 48 months. Finally, the 
major failure mechanisms and their root causes are studied. Several recommendations are 
provided if implemented are likely to enhance the current reliability levels of the MFP. 

The MFP is just one of many key plant components that must be studied in detail to 
determine their individual impact on the overall plant forced outage rate. Future studies should 
use the methodology developed in this chapter to focus on and improve those systems or 


components which have the largest contribution to the overall plant forced outage rate. 
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Chapter 7 - Other Fuel Cycle Extension Considerations 


7.1 Introduction 


This chapter presents a number of mostly managerial issues which are important 
considerations in achieving a 48 month cycle. The chapter 1s divided into three main sections; 


general issues, on-line surveillance performance issues, and surveillance interval extension issues. 


7.2 General Issues 


7.2.1 Management 


The top two priorities of plant management are safe and economic plant performance - in 
that order. However, in order to compete tn a deregulating industry, economic operation has 
gone from a distant to a much closer second. Management must make nuclear plants cost 
competitive or they will not survive. The urgency of the situation calls for innovative ideas for 
improving plant economic performance. Fuel cycle extension 1s such an idea, but it is not an 
appropriate strategy for the poorest performing plants. For such plants, the benefits of extended 
fuel cycles can probably not be realized without extensive changes in basic management practices. 


Without these changes, extended cycles are likely to result in an economic penalty. 


This hypothesis gains further credence when one analyzes the U.S. nuclear industry 1995 
outage lengths. Although this one year does not provide enough data to make a statistically 
robust analysis, some interesting observations can be made about the data. For the purposes of 
this analysis, plants with operating cycles of greater than 20 months were considered to have 
extended cycle lengths. Assuming that cycle length has no tmpact on refueling outage lengths, the 
plants with pre-outage operating cycles greater than 20 months should be about evenly divided 
over the entire spectrum of refueling outage lengths ranging from 23 days (the best) to 152 days 
(the worst). In this one data set snapshot, this does not appear to be the case. The data leads one 


to the conclusion that extended cycle lengths may have a correlation with refueling outage lengths 
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for the poorer performing plants (as measured by total outage length) while it has no effect on the 
best performing plants. Figure 7-1 shows that longer cycle length plants make up a larger than 
expected percentage (36%) of the 1/4 of plants with the shortest outage lengths. But, they also 
make up a larger than expected percentage (44%) of the 1/4 of plants with the longest outage 
lengths. Additionally, the average outage length for the 1/4 of plants with the longest outage 
lengths rises dramatically as compared to the rise in average lengths seen over the first three 1/4 
regions. This indicates that extending a plant’s cycle length may exacerbate outage lengths for 
plants with poor performance records. These plants would perhaps do better by concentrating on 
improving performance at their current cycle lengths rather than risking the costs of an extended 


outage length following an extended operating cycle. 


1995 Nuclear Industry Outage Lengths 
Percent and Average Outage Lengths of Plants 
with Pre-Outage Cycle Lengths Greater >20 Months 
in each Quarter 


Figure 7 - | 
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Top 1/4 2nd 1/4 3rd 1/4 Bottom 1/4 
Outage Length Group (Days)- All Plants 


While this data set is not large enough to draw absolute conclusions from, it does point 
out that utilities must consider in advance that longer run times may affect refueling outage 
lengths if all the possible ramifications of an extended cycle length are not considered. In order to 
capture the benefits of extended operation, the demands of high quality in equipment and 


operations grow rapidly. 
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Interestingly, the people in the industry currently most optimistic about extending fuel 
cycles are those who are also managing the top performing plants. These people believe that, in 
general, current plant hardware will support fuel cycle extension. And since these people are 
running plants at the highest levels of productivity in the industry, it is likely that they are 


sufficiently in tune with their systems. 


Though they are not doing it with fuel cycle extension specifically in mind, many of the 
best plants are already pursuing the type of surveillance performance originality necessary to 
adopt an extended fuel cycle. They are actively looking for surveillances which can be performed 
on-line and surveillances whose historical records support performance interval extension. As a 
result, they are regularly petitioning the NRC for line item technical specification changes. These 
plants recognize that such pursuits ultimately cut costs regardless of cycle length. All plants 


should pursue optimization of their surveillance programs. 


One of the best ways to optimize a plant’s surveillance program 1s through implementation 
of the Improved Standard Technical Specifications (ISTS). In most cases, the ISTS’s will result 
in fewer required surveillances. Just as important, the use of the ISTS will ensure timely NRC 


response when changes are requested to the technical specifications. 


7.2.2 Modes of Transition 


This thesis proposes a strategy for achieving a 48 month fuel cycle. The 48 month interval 
was chosen because it was within practical core load limits and yet is significantly longer than any 
cycle currently employed or currently contemplated within the U.S. nuclear industry. One of this 
thesis’s primary objectives was to prove that the regulatory barriers to an extended fuel cycles 
could be overcome. However, the best method of achieving a 48 month cycle 1s probably not in 


one abrupt fuel cycle extension, but rather in incremental changes from 24 to 36 to 48 months. 


From an engineering standpoint it 1s probably more prudent to adopt a 48 month operating 
cycle incrementally since the long term operating performance of many major plant components in 
the interval between 24 and 48 months 1s not well understood. By increasing cycle lengths 
incrementally, data on longer term operating performance and failure mechanisms can be 


gathered. With this data, maintenance, design, and operating strategies to support longer 
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operating cycles can then be developed. While abrupt transitions may be possible, a gradual 


transition to an extended cycle length is much more likely to be successful. 


7.2.3 Mid-Cycle Maintenance Outages & Surveillance Performance Hotlists 


The age and physical condition of some systems at some plants will create obstacles to a 
48 month operating cycle. Ifa surveillance is important economically in terms of the Limiting 
Plant Event Frequency (LPEF), and cannot be performed either on-line or shutdown at 48 month 
intervals, a plant may need to shut down during the operating cycle to perform the surveillance. 
Chapter 4 provided a list of surveillances which are likely to fall into this category. Of these, 
Steam Generator Eddy Current testing and ESFAS testing take the longest to perform and are 
candidates for performance during a mid-cycle maintenance outage. Based on historical records, 


this mid-cycle outage is estimated to take on the order of 10-14 days. 


Although it may be necessary, a planned mid-cycle maintenance outage erodes the 
capacity factor gains which are the impetus to the entire extended fuel cycle project, and should 
be avoided if possible. As an alternative, plants should be prepared to use reduced power 
windows or forced outages to accomplish Category C type surveillances as long as the 
surveillance performance does not unnecessarily extend the forced outage length. Since it 
typically takes a plant about two to three days to recover from a forced outage, there should be 
plenty time to complete the Category C surveillances identified in Chapter 4, with the exception of 
ESFAS testing and Steam Generator Eddy Current testing, if they have been pre-planned and can 
be started within a couple of hours notice of a forced outage. Given that the current cycle length 
record is less than 700 days, forced outage windows are likely to be available for most of the 


Category C surveillances. 


As a concluding thought, as Chapter 3 shows, only 54 of the 3108 surveillances evaluated 


pose potential barriers to a 48 month fuel cycle. 


19] 








7.2.4 Odd Length Surveillance Intervals Greater Than Target Cycle Length 


A relatively minor issue, but one that can easily be overlooked, is that of odd length 
surveillance intervals. Odd length surveillances, are those surveillances performed shutdown, 
whose current performance intervals are longer multiples of the current cycle length, but whose 
performance intervals would not be multiples of an extended cycle length. For example, an 
electrical surveillances is currently performed every 72 months which is a multiple of the current 
cycle length of 18 months. Ifthe cycle length is changed to 48 months, a decision must be made 
as to whether to perform the surveillance more frequently at 48 month intervals or attempt to 
technically justify extending the MOV performance interval to 96 months. Both options have 
potential benefits and drawbacks, although 96 months would obviously be a better goal so that the 
surveillance would not have to be performed every refueling outage. Another reason to aim for 
the 96 month performance interval is that some surveillances (such as operability tests of safety 
system motors) ultimately decrease component life expectancy because of the added wear 
resulting from surveillance performance. Consequently, somewhere in the fuel cycle transition 
process, engineering attention needs to be given to surveillances with odd length performance 
intervals. The total number of surveillances with odd length surveillance intervals greater than 48 


months are identified in Chapter 3. 


7.2.5 Radiation Exposure 


Adopting a four year operating cycle may have an effect on the radiation exposure 
received by plant personnel. The yearly collective dose received from refueling outages will tend 
to decrease since the interval between refuelings will be extended and the number of surveillances 
performed during refueling outages will be reduced. However, increasing the number of 
surveillances performed on-line may increase the total collective dose since general area radiation 


levels are higher with the plant at power. 


As an example of the possible changes in radiation dose from an extended cycle, the 


following data was taken from a local BWR: 
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24 Month BWR Radiation Data 


Table 7- I 









Satake 
ote 


Annual collective dose excluding refueling 
outages 









Average annual collective dose over 24 months 300 man-rem [(69+321+(2*100))/2 


To compare the 24 month surveillance program average annual collective radiation dose 


to a possible 48 month surveillance program the following assumptions were made: 


1. General area radiation levels during on-line operations are about twice those shutdown. 


2. Half of the surveillances currently performed shutdown will be performed on-line and half will 
continue to be performed during shutdowns with the shutdown exposure half the on-line 
exposure. 


3. There will be a 25% increase in refueling operation dose due to a loss of proficiency from 
’ performing refueling operations once every 48 months as compared to 24 months. 


4. The average annual collective dose excluding refueling outages will remain unchanged. 
Using these thumbrules, the approximate average annual collective dose from a 48 month 


cycle would be as follows: 


Estimated 48 Month BWR Exposure 


Table 7- 2 
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These values are rough estimates and will change depending on the assumptions used, 
most notably the on-line general area radiation levels and the refueling operation dose. However, 
the rough estimates demonstrate that a drop in radiation exposure is possible from an extended 
fuel cycle and are within the INPO’s goals for annual collective dose (250 man rem for a BWR by 
the year 2000). Relative changes in the dose estimates from a PWR should be considerably 


smaller. 


7.2.6 Integrated Outage Teams 


One of the concepts being looked at by the company which owns the candidate PWR is 
the use of integrated outage teams to reduce maintenance costs. In this concept, experts in 
particular fields are looked upon as resources for a series of plants within a network, as opposed 
to experts for one particular plant only. In this way, an expanded talent pool ts available to 
address problems within the utility. Lessons learned and experience gained from one plant can be 
applied to other plants within the company to improve the performance of all the plants. 
Additionally, in an era of downsizing, having experts available for all plants within a utility means 
that the total workforce can be reduced. Integrated outage teams are particularly well suited for 


complex outage evolutions such as refueling operations or steam generator eddy current testing. 


7.3 On-Line Performance [Issues 


7.3.1 Risk Monitors 


On-line risk monitoring software such as Sentinel and Equipment Out of Service (EOOS) 
are being incorporated throughout the nuclear industry. These monitors are Probabilistic Risk 
Assessment (PRA) based tools which help to quantify the increased risks involved with taking 
systems and combinations of systems out of service while the plant is operating. Although not all 
U.S. plants are employing well developed risk monitors, risk monitors will undoubtedly play a 
role in the safe performance of the extensive on-line testing and maintenance activities needed to 


achieve a four year operating cycle. 
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Plant risk monitors are developed and maintained by PRA engineers. They are designed 
for use by both surveillance schedulers and plant operators. The monitors enable surveillance 
schedulers to quantify the risks involved with performing one or more maintenance or testing 
activities in a given plant mode. The schedulers can then optimize work schedules by managing 
the risk associated with the different activities. For the operator, the risk monitors identify which 
systems are most important to maintain operable given that another system is inoperable. For 
example, if a emergency diesel generator is taken off-line, a risk monitor would tell the operator 
what the overall increased risk is in terms of the Core Damage Frequency (CDF) and would 
identify the steam driven Emergency Feedwater Pump as the most valuable safety system which 


should be maintained operable. 


Although PRA based risk tools which emphasize CDF are well developed, more effort 
must be concentrated on an economic Limited Plant Event Frequency (LPEF) tool. This tool 
would be an economics based PRA tool and include CDF as one of the limiting plant events 
because of its enormous economic impact. It could function as both an on-line monitor for 
operators to use and as a more detailed stand alone tool for planners to use when developing the 
entire surveillance program for a 48 month fuel cycle. The possible inputs and methodology for a 


PRA based economic LPEF tool are discussed in more detail in chapter 2. 


7.3.2 NRC Perspective 


The NRC supports the concept of on-line surveillance performance and recognizes its 
importance to the economic competitiveness of the nuclear industry. In contrast to refueling 
outages, more attention can be focused on the safe performance of on-line surveillances because 
there are not as many activities competing for the time and attention of plant personnel. In 
addition to the extra oversight and attention to detail which can be given to on-line surveillances 
performance, it is safer to perform some surveillances on-line. One example is the Residual Heat 
Removal (RHR) system. The system is not required with the plant at power. However, during 


refueling operations it is a vital decay heat removal source. Because of this, it is more risk 
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significant when the plant is shutdown than when the plant is operating. Therefore, RHR 


surveillances are safer if performed at power. 


Probably the major concern the NRC has with on-line surveillance performance 1s that 
plant personnel often do not have a firm understanding of the consequences and possible 
contingencies required when a particular system is removed from service. To avoid this, plant 
management must instill the proper safety culture and take an active role in ensuring that all 


workers are thoroughly prepared prior to on-line surveillance performance. 


7.3.3 Degradation from Over-Testing 


The possible negative effects of increasing surveillance performance frequency for a 
surveillance which can now be performed on-line must be carefully understood. Surveillance 
performance frequency should not be arbitrarily increased. For example, human errors introduced 
during surveillance performance can cause a system which was performing well to experience 
problems upon return to operational status. Consequently, a thorough justification in terms of 
either LPEF or CDF should be made before increasing a surveillance’s frequency. Poorly planned 


frequency increases could ultimately result in increases in either the LPEF or CDF. 


7.4 Performance Interval Extension Issues 


7.4.1 Quantification of Extension Justifications and Data Availability 


The NRC’s Generic Letter 91-04 identifies the documentation required to extend technical 
specification surveillance intervals to 24 months. In order to extend the calibration interval on 
instrumentation, a utility must present a detailed, quantified justification “in order to confirm that 
drift will not result in instrument errors that exceed the assumptions of the safety analysis.” 
However, non-instrumentation surveillances requirements for interval extension Justification are 
not as quantitative and can be based heavily on past material history and expert judgment. In 


addition to ensuring that the increased interval does not invalidate any assumption in the plant 
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licensing basis, the NRC requires that historical maintenance and surveillance data be checked to 
be sure that such records validate the expert opinion. In fact, Generic Letter 91-04 states that 
utilities “need not quantify the effect of the change in surveillance intervals on the availability of 


individual systems or components.” 


One of the likely reasons for not requiring a more quantified approach to performance 
interval extension justifications is the lack of solid data upon which to make quantitative 
judgments. The data deficiency is a problem in many sectors of the nuclear utility industry. 
Ultimately, the lack of data availability and trending 1s a problem which can be solved if given a 
high enough priority by management. Since it is reasonable to assume that expert judgment will 
not be sufficient to justify every non-instrumentation surveillance out to 48 months, this 1s a 


problem which must be solved if a four year cycle is to become a reality. 


7.4.2 Insurance Costs and Vendor Guarantee Issues 


Extending the interval between testing of some plant components may have an impact on 
the cost of insurance to the industry. Initial conversations with the Nuclear Mutual Limited 
(NML)” indicate that from a regulatory standpoint, that as long as the NRC agrees with the 
changes necessary to obtain a 48 month fuel cycle, that no rate changes would occur on the 
systems under the responsibility of the NRC. On the Balance of Plant (BOP) side, NML has 
developed loss control standards, agreed upon by the industry, which detail the required 
Inspections and performance intervals for all major pieces of equipment. This includes such items 
as the Main Turbine and Main Feed Pumps. As long as the current inspection interval for these 
major components is greater than 48 months they will not have an impact on the insurance rates 
charged the utily, Any components with inspection intervals inside of 48 months will have to be 


studied further to determine any changes in the insurance rates charged a utility. 


*? Phone conversation between Thomas Moore, MIT, and Greg Wilks, NML, of 1 May 1996. 
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7.5 Summary 


This chapter presents a few of the many issues that must be considered prior to 
implementing an extended fuel cycle program. The main purpose of the chapter was to point out 
that even if technically feasible, the benefits of extended fuel cycles will depend just as much, if 
not more, on a proactive and forward thinking managerial approach to the myriad of issues that 
must be properly addressed to successfully implement an extended fuel cycle program. Many of 
the issues discussed here also have applicability to improved economic performance eperdless of 


cycle length. Ultimately, strong management, and excellent operational and maintenance teams 


. will be the key factors in whether the 48 month fuel cycle will provide the economic benefits 


touted here. 
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Chapter 8 Summary and Future Work 


8.1 Summary 


Heading into the 21st century the U.S. nuclear industry must be willing to expand 
the goal of each plant from safe performance, to safe and economic performance, and 
apply this type of thinking in all its decision making processes if it hopes to remain 
competitive in a deregulated electric power market. This thesis has focused on improving 
plant economic performance by developing a strategy for increasing plant cycle lengths to 
48 months or more. The strategy addressed the key issues of matching the current 
regulatory and investment protection surveillance programs to a 48 month cycle, and | 
determining the impact of 48 month cycles on component reliability and overall plant 
forced outage rates. 


The goals and objectives of the thesis were to: 
e Overcome the regulatory and investment protection barriers to extended cycle lengths 


e Provide a systematic surveillance resolution procedure that utilities can use to prepare 


for extended cycle lengths 


e Develop an initial framework for a key plant component to demonstrate how key plant 
components can operate for extended periods of time between maintenance without 


adversely impacting the plant forced outage rate. 


The first step in meeting the stated goals and objectives of the thesis was to 
develop a detailed methodology for resolving the current regulatory and investment 
protection surveillance programs to a 48 month cycle. The methodology produced 
recommendations for each surveillance regarding its compatibility to a 48 month fuel 


cycle. The three major categories of recommendations were: 


e Category A Surveillance - A candidate for on-line performance. 
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e Category B Surveillance - A candidate for performance interval extension to 48 


months. 


e Category C Surveillance - A potential barrier to a 48 month cycle requiring further 


study. 


As part of this methodology an economic optimization model was developed. The 
purpose of the economic optimization model was to recognize that many surveillances fit 
into both the on-line performance and extended interval performance categories, and that 
there is an optimum mix of these surveillances which produces maximum economic benefit 
while maintaining current plant risk levels. The economic optimization model also 
introduced the concept of the Limiting Plant Event (LPE). LPE’s, which include all 
events with a significant economic impact, define the entire set of risks which must be 
controlled to achieve economic success. Since the rationale behind any length fuel cycle 
extension program is improved economic performance, the LPE frequency is the critical 


factor that must be considered tn any surveillance resolution program. 


To meet the first two stated goals and objectives of the thesis, the surveillance 
resolution methodology was applied to the regulatory and investment protection 
surveillance programs at an operating Pressurized Water Reactor (PWR). All 
surveillances which were currently precluding a 48 month fuel cycle were considered. Of 
the 3,108 surveillances currently performed shutdown at intervals less than 48 months, 
2,673 are likely candidates for on-line performance, 381 are likely candidates for 
performance interval extension to 48 months, and 54 remain as likely barriers to a 48 
month fuel cycle. Of the 2,673 surveillances which are candidates for on-line 
performance, 67 require a reduced power window for on-line performance. Performance 
of these surveillances during a reduced power window is likely to produce a net economic 
benefit as compared to the shutdown performance option, if shutdown performance of 
these surveillances takes more than 2.9 days. A recommended performance sequence for 
these reduced power window surveillances and economic analysis ts included. 

The 54 surveillances which are potential barriers to an extended fuel cycle 


(Category C) are evenly divided between the regulatory and investment protection 
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surveillance programs. On the regulatory side, several motor-operated safety injection 
valves and steam generator eddy current testing are potential barriers to a 48 month fuel 
cycle. On the investment protection side, condenser waterbox maintenance and several 
reactor coolant pumps surveillances also pose likely barriers to a 48 month fuel cycle. 
Relief valve testing 1s a common regulatory and investment protection surveillance barrier 
to extended cycles. Based on a review of historical performance times, the Category C 
surveillances require about 12-14 days to complete with the plant shutdown. 

As part of an actual PWR 24 month fuel cycle extension program, a technical 
justification for extending the testing interval of the Primary Component Cooling Water 
(PCCW) from 18 to 24 months was developed. Additionally, as part of this effort, 
detailed instructions for the completion of technical evaluations suitable for submission to 
the Nuclear Regulatory Commission (NRC) were drafted. Both are included in this thesis 
to demonstrate the level of effort required to perform a complete 48 month fuel cycle 
surveillance resolution project. 

To meet the final goal and objective of the thesis, a three part methodology was 
developed for studying the impact of key plant components on the overall plant forced 
outage rate. The thesis forced outage rate goal was derived from the current Institute for 
Nuclear Power Operations (INPO) forced outage rate goal of less than 3%. The 


methodology for studying key plant components involved: 
e Determining the current component or system reliability levels 


e Determining the major component/system failure mechanisms, the root causes 


of failure, and providing recommendations for their correction 


e Determining the current surveillance program’s impact on overall component 


or system reliability 


The methodology was first applied to the Main Feed Pump (MFP). The MFP was 
chosen because of its relative simplicity, access to pump experts, and the availability of 
some actual failure rate data. Using data obtained from a review of Licensee Event 
Reports (LER) and the Nuclear Plant Reliability Data System (NRPDS) MFP failure rates 
of 6.46*10°/hr and 1.57*10°/hr respectively were calculated. When combined with an 
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estimated average time to repair of 53 hours obtained from a review of the NRC 
maintained industry outage database, both the LER and NPRDS derived failure rates were 
well under the calculated failure rate of 3*10/hr needed to achieve a system 97% 
capacity factor. 

The major MFP failure mechanisms and their root causes were determined based 
on a review of feed pump failure data and extensive interviews with industry 
representatives, pump consultants, pump vendors, and major sub-component vendors. 

The major causes of MFP failures were the seals, bearings, pump structures, and the speed 
control systems. The major root causes of these failures were vibration, system 
cleanliness, and improper system design. 

The current surveillance program at the candidate PWR was reviewed to 
determine its impact on MFP reliability and the MFP contribution to the overall plant 
forced outage rate. All surveillances performed at frequencies of less than 48 months 
involved the testing of various MFP trips, alarms, and speed control systems. These types 
of surveillances are designed to prevent damage to the MFP from abnormal plant 
conditions, but in general do not contribute to the overall reliability levels of the pump. 

All surveillances which inspected or replaced major MFP components such as bearings, 
seals, or impellers, which would affect the long term reliability of the MFP are performed 
at intervals greater than 48 months. Based on the review of the MFP surveillance program 
in conjunction with the calculated failure rates and failure mechanism review, it was 
concluded that the MFP could be expect to operate reliably on a 48 month fuel cycle 
without adversely impacting the overall plant forced outage rate. 

Finally, many of the important managerial issues related to extended cycles were 
studied. One of the most significant findings was that there appears to be a relationship 
between operating cycle length and the subsequent refueling outage length. Plants that 
had operating cycles greater than 20 months tended to be either amongst the 25% of 
plants with the shortest refueling outage lengths or in the 25% of plants with the longest 
refueling outage lengths. This leads to the conclusion that the best performing plants will 
tend to receive the greatest economic benefit from an extended fuel cycle, while the worst | 


performing plants may actually incur an economic penalty by extending their cycle lengths. 
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The worst performing plants should concentrate on improving their performance at their 


current cycle length before considering moving to an extended cycle length. 


8.2 Future Work 


As a result of some of the findings of this thesis, there is significant future work 
that must be accomplished by the MIT Extended Fuel Cycle project to establish the 
technical basis upon which a utility decision to explore implementing an extended fuel 
cycle could be based. The future work includes a wide range of areas from economics to 
plant safety. 

Chapter 2 (Surveillance Resolution Methodology) introduced the concept of an 
Economic Optimization Model and the Limiting Plant Event Frequency (LPEF) as tools in 
making economic decisions. Actual development of this model using modern linear 
programming and probabilistic risk assessment techniques should be investigated. Further 
research should also be considered on quantifying the LPEF and the impact of plant 
configuration changes on the LPEF. This work should be similar in scope to previous 
work done on Core Damage Frequency (CDF) such as in the RISKMAN software. Since 
CDF is only a subset of the entire set of LPE’s, developing this tool will require significant 
time and resources. 

Chapter 3 (Surveillance Categorization) qualitatively applied the methodology 
developed in Chapter 2 to determine the optimum performance mode of each surveillance. 
As part of this effort, research must be conducted on developing a quantitative method for 
determining the optimum performance interval for all surveillances. Determining the 
optimum performance interval for both the surveillances that can be performed on-line and 
those that must be performed shutdown will improve economic performance by reducing 
the amount of maintenance that must be performed. Reducing the amount of maintenance 
performed is also likely to result in an additional reliability payoff by reducing the impact 
of human error on component reliability. 

Chapter 4 (Category C Surveillances) provided a complete description of the 54 
individual surveillances identified as potential barriers to a 48 month cycle. Some possible 


solutions to these surveillance barriers were proposed. However, more detailed 
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engineering work needs to be done on each of these surveillances. The detailed 
engineering work should propose a range of possible solutions utilizing existing and 
evolving state-of-the-art technologies. All engineering solutions must consider the cost of 
implementing the proposed changes. 

Chapter 6 (A Framework for Reducing Forced Outage Rates) proposed a 
framework for reducing plant forced outage rates. One of the key factors in prioritizing 
those components which should be studied first is the availability and accuracy of 
component failure rate data. Several databases of data exist such as the Licensee Event 
Reports (LER), Nuclear Plant Reliability Data System (NPRDS), and the NRC’s “gray 
book” which keeps track of industry wide outages and their causes. These databases need 
to be normalized so that the data sources are compatible with each other. Only by 
developing consistency amongst the data sources can accurate conclusions be drawn. 
Additional sources of data must continue to be pursued. With the data currently available, 
future work should study the prioritized component list and develop recommended 
solutions for reducing forced outage rates. The goal of the each study should be to reduce 
any time dependent component of failure over a 48 month cycle interval. 

Additional research should also continue on some of the more subtle management 
issues that must be addressed in order to make a smooth transition from current operating 
lengths to an extended operating cycle. A closer examination of the impact of cycle 
lengths on the nuclear industry’s insurance rates must be conducted. 

Finally, a detailed economic analysis must be performed that incorporates the costs 
of an extended cycle core with the potential operations and maintenance savings from 
extended cycle operations. Only if the nuclear industry is convinced that there is a short 
term (three to four year) payoff of an extended cycle core will extended cycle lengths ever 


be seriously studied for adoption. 


204 








Appendix A Instructions for Technical Evaluations 


Instructions for Completion of 
Fuel Cycle Extension 


Technical Evaluations 


A.1 Introduction 


The purpose of the technical evaluation is to provide a technical justification to the 
Nuclear Regulatory Commission for extending the performance interval of a surveillance 
in support of a fuel cycle extension project. This instruction outlines the methodology 
necessary to meet the requirements of NRC Generic Letter 91-04 “Changes in Technical 
Specification Surveillance Intervals to Accommodate a 24-Month Fuel Cycle” and ts 
adaptable to fuel cycles of various lengths. All personnel performing technical evaluations 
should read and be familiar with the requirements of Generic Letter 91-04 before 


attempting to complete a technical evaluation. 


For all evaluations, the evaluator must demonstrate the following: 

e The effect on plant safety is insignificant, and; 

e Historical preventative and corrective maintenance records, surveillance data, and 
other surveillances performed on system components support this conclusion, and; 

e The performance of the surveillance at the bounding surveillance interval limit will not 
invalidate any assumption in the plant licensing basis. 

Generic Letter 91-04 also addresses specific information that 1s required for surveillances 

involving Steam Generator inspections (PWR only), containment leak tests, and 

instrument drift. Evaluators involved with surveillances in these particular areas must 

ensure they understand any additional Generic letter requirements they must address in 


their evaluation. 


205 








A.2 Methodology 

Section 8.2.2 of this report is a technical evaluation completed for PWR technical 
specification 4.7.3.b. “Primary Component Cooling (PCC) Automatic Valve Actuation”. 
It provides a general format for technical evaluations suitable for submission to the NRC. 


A more detailed discussion of each section of the technical evaluation follows. 


A.2.1 Section I - Technical Evaluation Conclusion 

State the current technical specification frequency and whether or not the 
surveillance will support performance interval extension. If the evaluation supports 
extension of the surveillance interval, the wording of this paragraph should closely follow 


the wording shown in section 8.2.2 which is derived from Generic Letter 91-04. 


A.2.2 Section II - Description of Change 

Briefly describe the surveillance being evaluated and the individual components 
being tested if applicable. Individual components tested should be added as an attachment 
to the base report. The plant’s Final Safety Analysis Report (FSAR) provides an excellent 
reference description of the system and components involved in the evaluation. A 


description of the change requested to the current technical specification should follow. 


A.2.3 Section IIA - Open Items Section 

During the course of the evaluation, identify any potential conflicts with current 
operations or maintenance practices that would result from extending a surveillance 
performance interval. For instance, the PWR technical evaluation of section 8.2.2, 
performed on the PCC automatic valve surveillance, clearly supported extending the 
performance interval from 18 to 24 months. However, during the course of the 
evaluation, several maintenance items currently performed at multiples of 18 months 
(36,48,etc.) were identified which will have to be evaluated to determine the optimum 
performance interval consistent with a 24 month cycle (24, 48, 72, etc.). MOV’s for 
example are lubricated every 36 months. Half of the valves are lubricated every 18 


months to balance the work load. If it is not possible to extend the current performance 
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interval for lubrication from 36 to 48 months, than the lubrication performance interval 
may have to be shortened to 24 months and all MOV’s lubricated every outage. This may 
impact the length of the refueling outage and negate any benefits gained from transitioning 
to a 24 month fuel cycle when the total surveillance package 1s considered. This is an in 
house section to be used by the fuel cycle extension coordinator. Once the potential 


conflicts are resolved this section should be deleted prior to submission to the NRC. 


A.2.4 Section III - Evaluation of Change 

This is the most important section of the evaluation and forms the basis for the 
evaluation final conclusions. There are two major parts to this section, a potential system 
failure mode analysis to analyze possible problems that might occur beyond the current 
performance interval, and a review of the system/component past performance history. 
The methodology needed to complete each section 1s described in more detail below. A 


checklist 1s included at the end of this instruction to assist in performing this section. 


A.2.4.1 Potential System Failure Modes 


Evaluate the following areas: 


e What ts the purpose of the surveillance? 

For example, the purpose of the PWR PCC Automatic Valve Actuation 
surveillance is to confirm that if an accident occurs which requires an Engineered Safety 
Feature signal, the signal flows from the instrument, to a signal processor, to the motor for 
each required valve, and that the motor energizes and positions the valve within design 


time limits. 


e What could prevent the system/components from performing their function, and are 
there time dependent failure on the interval of concern? 
This section does not require a detailed failure effect mode analysis (FEMA) but 
should consider the major ways the system could fail. For example, for the PCC 


Automatic Valve Actuation surveillance, the system would fail to perform its function if 
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the sensor failed, the signal path or logic processor failed, the motor for any valve failed, 


or any valve mechanically failed to operate. 


e Are other surveillances performed on a more frequent basis than the surveillance being 
evaluated which confirm the proper operation of individual portions of the system? 
For example, for the PCC Automatic Valve Actuation surveillance, most of the 
valves are stroked, and the signal path confirmed on a quarterly basis to meet Inservice 
Testing requirements. The sensors can be checked to confirm they are operating properly 


by comparing redundant channel readings on operating logs. 


e For any parts of the system not checked on a more frequent basis by other 
surveillances, would a time dependent failure be expected to occur during the interval 
between the old and new performance intervals? 

To evaluate this section one should consider the margin between the actual 
performance of the system to its design basis performance limits, the operating 
environment of the components, and whether this environment would be expected to 
cause a prompt jump in failure probability during the interval extension. Comparing 
performance data from shorter previously used cycle lengths to the current cycle length 


may provide a useful baseline of any possible time dependent degradation in performance. 


e What is the operating environment of the system/component? 

Components that operate under high temperature, humidity, or radiation 
conditions may be more susceptible to time dependent failure modes on the interval of 
concern as compared to other similar components not subject to the same harsh 
environmental conditions. The environmental qualification (EQ) of the components 


should be verified with system engineers and EQ personnel. 
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A.2.4.2 Performance History 

The performance history section should be further subdivided into four specific 
sections. 

e Surveillance results 

e Corrective maintenance frequency and type 

e Preventative maintenance records 


e System Engineer consultation 


A.2.4.2.a Surveillance results Compile and review the results of all previous 
surveillance performances. Evaluate whether these surveillance results support a 
fuel cycle extension. Past surveillance results as shown in attachment 2 in section 


8.2.2 may be obtained through the individual plant databases. 


A.2.4.2.b Corrective maintenance frequency and type Compile and review the 
corrective maintenance history for the system being evaluated. The purpose of the 
review is to identify any potential failures which appear to be of a time dependent 


nature and which might be expected to occur inside the interval of concern. 


A.2.4.2.c Preventative Maintenance Records The purpose of this review is to 
ensure that there are no other preventative maintenance activities performed on the 
system/component with performance intervals in either years or refueling interval 


multiples which would interfere with extending the surveillance interval. 


A.2.4.2.d System Engineer Consultation. System engineers are an important 
source of information. They should be consulted early on in the evaluation process 
to obtain their opinions on the feasibility of extending the surveillance performance 
interval and to ensure that all pertinent sources of information necessary to 
complete the evaluation are being used. They should also be consulted near the 
end of the process to obtain comments and opinions on the rough draft of the 


evaluation before final submittal. 
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A.2.5 Section IV- Significant Hazards Evaluation 


Complete this evaluation in accordance with 1OCFR50.92. This part of the 


evaluation forms the basis for the licensing department’s request for interval extension to 


the NRC. The evaluation must address the following: 





(1) The proposed change does not involve a significant increase in the probability 
or consequences of an accident previously evaluated. 

(2) The proposed change does not create the possibility of a new or different kind 
of accident from any accident previously evaluated 

(3) The proposed change does not involve a significant reduction in a margin of 


safety 


Section 5.2 of this report provides an example of the format and information required in 


this section. 


A.2.6 Section V - Sources of Information 


The following sources of information should be used to complete the technical 


evaluation: 


Station Technical Specifications 

Station Final Safety Analysis Report 

Station surveillance procedures 

System drawings 

System engineers 

Environmental Qualification engineers 

Annual System Performance Reports 

Generic Letter 91-04 “Changes in Technical Specification Surveillance Intervals to 


Accommodate a 24-Month Fuel Cycle” 
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Fuel Cycle Extension 
Technical Evaluation Checklist 


-Potential failure modes of components tested by the surveillance do not 
have time dependent failures that are so short that they would be expected 
to occur on the interval of concern 


-Failure probability analyzed based on plant and industry data a ae 


-Affect of failure has been analyzed 
-Components that are not checked by other surveillances on a more frequent 





basis do not have time dependent failure modes that would be expected to 
occur on the interval of concern 

-Other surveillances are performed on system components on a more 
frequent basis which confirm continued component performance 


--Is the component or system stand alone, if not, do support systems 
performance support interval extension? 








-Corrective maintenance history supports a conclusion that there have been 
no failures of a time dependent nature 

-Other preventative maintenance performed on the system does not prevent 
interval extension | 

~System Engineers and system experts support the conclusion that the 
surveillance interval can be safely extended 

Plant Data Required 

Planned Maintenance History (Tech Spec) 

Corrective Maintenance History 


Planned System Maintenance (Tech Spec) 
Planned System Maintenance (Non-Tech Spec) 
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